Aman-Mittal commented on issue #214: URL: https://github.com/apache/fineract-backoffice-ui/issues/214#issuecomment-5158695101
Done and merged in #217. `setApiUrl` now validates against an allow-list and returns whether it accepted, so the login form refuses **before** authenticating rather than after — the password never reaches an unsanctioned host. Same-origin endpoints are always permitted; an absolute one must match this document's origin or an origin the deployment named in `config.json` via the new `allowedApiOrigins` key. A stored override clears the same bar on load: local storage is writable by anything running as the page, so it is not more trusted than a fresh value. One bug worth recording, caught while implementing: the check initially read the config signal, but `getStoredOverride` runs inside a field initialiser — before that signal exists — so it would have thrown on startup, on the one path every user hits. The predicate takes the allowed origins as an argument instead. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
