Aman-Mittal opened a new issue, #212:
URL: https://github.com/apache/fineract-backoffice-ui/issues/212
Tracking issue for the blocking failures reported by `npm run ga:check`.
At the time of writing the check reported **3/8 gates passing, 4 blocking
failures**. Each was
verified in the code rather than taken on the report's word.
## The failures, and why they compound
1. **`Authorization` is sent to every destination.** `authInterceptor`
clones in `Basic <token>`
whenever a session exists, with no check on where the request is going.
2. **`setApiUrl()` accepts any string.** It writes straight to config and
local storage with no
validation, so the endpoint the credentials are posted to can be set to
anything.
3. **The login form offers third-party API hosts.** External demo endpoints
were hard-coded as
selectable options on a credential-entry form.
4. **`deploy/nginx.conf` sets no security headers.** No CSP, HSTS,
`X-Frame-Options`,
`X-Content-Type-Options` or `Referrer-Policy`.
These are worse together than apart. (3) makes (2) a one-click action, and
(2) makes (1) a
credential leak: point the app at a host you control, and the next request
carries the user's
Basic credentials to it. (4) removes the browser-side backstop that would
otherwise limit where
an injected script could send anything.
Nothing in the application calls a third party today, which is precisely why
this is cheap now —
the first analytics pixel, error reporter or vendor SDK sharing this
`HttpClient` would inherit
the problem silently.
## Sub-issues
- Restrict the `Authorization` header to the API origin
- Validate the API endpoint override against an allow-list
- Remove hard-coded third-party hosts from the login form
- Set HTTP security headers in the deployed nginx config
## Not in scope
The advisory adapter-boundary backlog is a long migration tracked
separately; `npm run lint`
already blocks new violations, so the count only falls.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
