Vitor-Avila commented on PR #43606: URL: https://github.com/apache/superset/pull/43606#issuecomment-5479819779
hey @aminghadersohi, thanks for working on this! I'm just curious if we really need the marker? It isn't bound to a session or user, so an attacker can mint one with an unauthenticated `curl /login/?next=/anything` and hand the result to a logged-in user. But `get_safe_redirect` already keeps `next` same-host, so they could just send `/anything` directly anyway (there's nothing extra being opened up by an unmarked `next`). I understand we're solving a redirect loop, but signing feels like overkill for that when a plain `?login_redirect=1` would distinguish the two entry points just as well. Also, the marker is minted when the login page loads, so other tabs that are stale for a longer time could be impacted. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
