Consider if we have a security issue when specifying action without `type`

integreat-io / integreat

Node.js integration layer

Other

14 stars 3 forks source link

Consider if we have a security issue when specifying action without `type` #229

Open kjellmorten opened 1 year ago

kjellmorten commented 1 year ago

Most actions will have payload.type, but if you specify a targetService you may not be required to. However, the authorization uses payload.type to check what auth schema to use, and no type means no authorization.

This should be addressed.