Aman-Mittal opened a new issue, #213: URL: https://github.com/apache/fineract-backoffice-ui/issues/213
Part of the GA security hardening work. ## Summary `authInterceptor` attaches `Authorization: Basic <token>` to every outgoing `HttpClient` request whenever a session exists. There is no check on the destination — confirmed by reading the file: no URL comparison appears anywhere in it. The tenant header goes out unconditionally too. ## Business value **The first third-party integration ships banking credentials to a vendor, and nothing reports it.** Today nothing in the application calls a third party, so there is no live leak. That is exactly what makes this cheap to fix now and expensive later: the moment someone adds an analytics pixel, an error reporter, a document-storage SDK or a credit-bureau call through the same `HttpClient`, that vendor starts receiving credentials that unlock the institution's entire Fineract instance. Nobody would see it happen — the header is added by an interceptor nobody edits, in a file nobody revisits. The tenant header matters as well, if less severely: it names the institution, so sending it off-origin discloses which organisation the deployment belongs to. ## Scope Attach credentials and tenant headers only when the request is bound for the configured API. A relative URL is same-origin by construction and stays trusted; an absolute one is compared by origin, so a path change on the same host remains trusted and a different host does not. A deployment whose Fineract is legitimately on another origin is supported — that one origin is trusted, and only that one. ## Acceptance criteria - [ ] No `Authorization` header on a request to a foreign origin. - [ ] No tenant header on such a request either. - [ ] Relative and same-origin absolute requests are unaffected. - [ ] A cross-origin API configured by the deployment still authenticates. - [ ] Unit tests cover each of the above. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
