Closed michaelbragg closed 5 years ago
This doesn't validate that the login is actually coming from the hd domain, however. An attacker could just take the hd=XXX.com out of the URL and then they'd be able to access using their own google account. I like the idea, though.
Thanks @cdwiegand, how would you recommend addressing this?
Would this be done before WordPress creates the user? Or is there a better point to conduct the validation of the domain?
I haven't fully looked through the code, but I'm thinking in wpoa_login_user you'd have to re-check that if the get_option('wpoa_google_api_hd') setting isn't blank that the user's email ends with "@" and then that setting, ideally case insensitive.
Hosted Domain is used to limit access to Google accounts from a specified domain.
I've tested this in our corporate environment. May need some more testing as our setup handles failed login's slightly different to the normal Google process.