search

ledgerconnect / steemconnect

Signer app for Steem
https://steemconnect.com
MIT License
159 stars 88 forks source link

Misconfigured CORS #34

Closed roadscape closed 7 years ago

roadscape commented 7 years ago

From https://github.com/steemit/condenser/issues/1492:

1) It uses Security.allowDomain("*") which is extreamly dangerous https://steemconnect.com/profile Security Impact of CORS Misconfig http://yassineaboukir.com/blog/security-impact-of-a-misconfigured-cors-implementation/

bonustrack commented 7 years ago

This is not an issue on steemconnect.com. The interface don't expose user related information on the source code see view-source:https://steemconnect.com/profile, it just show a _csrf code which change on every request and can't be used by malicious actor. We will take this in consideration for SC2 aswell.