Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Minor: A trailing "/" prevents identification of trusted apps #74

Open
NSeydoux opened this issue Oct 15, 2019 · 3 comments
Open

Minor: A trailing "/" prevents identification of trusted apps #74

NSeydoux opened this issue Oct 15, 2019 · 3 comments
Assignees

Comments

@NSeydoux
Copy link

If the domain declared for a trusted app ends with a "/" character, the app running is returned "403: Unauthorized Origin" when performing operations it should be allowed to (e.g. resource creation).

Users typically won't declare a domain ending with a "/", but wen copy/pasting for instance, this may happen (that's how I discovered this). I'm not completely sure this is an issue, but it may be worth at least documenting, or removing the trailing "/" automatically.

@megoth
Copy link
Contributor

megoth commented Oct 15, 2019

A good point, and it shouldn't be difficult to normalize URLs.

@Vinnl Vinnl self-assigned this Oct 16, 2019
@Vinnl Vinnl removed their assignment Oct 16, 2019
@jaxoncreed
Copy link
Contributor

There is the question on how NSS should handle this if it does have a trailing slash in the url or even if the url contains a full path like example.com/path/to/item. I'd say it would make sense for a 403 error to be returned. As example.com/path/to/item is not a valid origin, it should be skipped for evaluation. Therefore, the origin example.com is still not registered as a trusted app and should be rejected.

@megoth megoth self-assigned this Dec 17, 2019
@megoth
Copy link
Contributor

megoth commented Dec 17, 2019

Thank you for the input @jaxoncreed - I'll solve this by implementing some proper checks in the trusted app view ^_^

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants