Aman-Mittal opened a new issue, #213:
URL: https://github.com/apache/fineract-backoffice-ui/issues/213

   Part of the GA security hardening work.
   
   ## Summary
   
   `authInterceptor` attaches `Authorization: Basic <token>` to every outgoing 
`HttpClient` request
   whenever a session exists. There is no check on the destination — confirmed 
by reading the file:
   no URL comparison appears anywhere in it. The tenant header goes out 
unconditionally too.
   
   ## Business value
   
   **The first third-party integration ships banking credentials to a vendor, 
and nothing reports
   it.**
   
   Today nothing in the application calls a third party, so there is no live 
leak. That is exactly
   what makes this cheap to fix now and expensive later: the moment someone 
adds an analytics pixel,
   an error reporter, a document-storage SDK or a credit-bureau call through 
the same `HttpClient`,
   that vendor starts receiving credentials that unlock the institution's 
entire Fineract instance.
   Nobody would see it happen — the header is added by an interceptor nobody 
edits, in a file nobody
   revisits.
   
   The tenant header matters as well, if less severely: it names the 
institution, so sending it
   off-origin discloses which organisation the deployment belongs to.
   
   ## Scope
   
   Attach credentials and tenant headers only when the request is bound for the 
configured API. A
   relative URL is same-origin by construction and stays trusted; an absolute 
one is compared by
   origin, so a path change on the same host remains trusted and a different 
host does not. A
   deployment whose Fineract is legitimately on another origin is supported — 
that one origin is
   trusted, and only that one.
   
   ## Acceptance criteria
   
   - [ ] No `Authorization` header on a request to a foreign origin.
   - [ ] No tenant header on such a request either.
   - [ ] Relative and same-origin absolute requests are unaffected.
   - [ ] A cross-origin API configured by the deployment still authenticates.
   - [ ] Unit tests cover each of the above.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to