[
https://issues.apache.org/jira/browse/SLING-2572?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Carsten Ziegeler updated SLING-2572:
------------------------------------
Component/s: (was: General)
Authentication
> Redirect validating service
> ---------------------------
>
> Key: SLING-2572
> URL: https://issues.apache.org/jira/browse/SLING-2572
> Project: Sling
> Issue Type: Improvement
> Components: Authentication
> Reporter: Jeff Young
> Labels: security
>
> Clients need to validate redirects to esure that they point on-site (or
> perhaps to an authority on a white-list) to prevent phishing attacks. A
> Sling service which performed this would allow consistency (and a single
> point of extension).
> There already exists AuthUtil.isRedirectValid() [0], but it doesn't handle
> URLs (only paths), and disallows relative paths (the second of which, at
> least, is widely used).
> There is also a referrer validating service [1] which might provide a better
> starting point.
> Lastly, if we had backward-compatibility concerns with some of the algorithms
> encoded in those methods/services, we might choose to provide a very basic
> default implementation which simply drops any scheme and/or authority from
> the URL, and let customers do white-lists and/or other more sophisticated
> checks as customizations.
> References:
> [0]
> https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/core/src/main/java/org/apache/sling/auth/core/AuthUtil.java
> [1]
> https://svn.apache.org/repos/asf/sling/trunk/contrib/extensions/security/impl/ReferrerFilter.java
--
This message was sent by Atlassian JIRA
(v6.2#6252)
