search

webplatform / fxa-content-server

Firefox Accounts Content Server (w/ WebPlatform customizations)
http://docs.webplatform.org/wiki/WPD:Projects/SSO/Adapt_Firefox_Accounts_for_WebPlatform
0 stars 0 forks source link

More secure domain checking #2

Open tilgovi opened 9 years ago

tilgovi commented 9 years ago

https://github.com/webplatform/fxa-content-server/blob/2086c0846a120f5e141ef4c443eae273599de37a/app/scripts/views/channel.js#L40

There's no '.' in front of the domains, so myfakewebplatform.org would pass.

tilgovi commented 9 years ago

cc @renoirb

renoirb commented 9 years ago

Clever finding. Will do that!