Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enforce schema in Callback URIs and use full URI in abandon auth UI #62

Open
fisher60 opened this issue Nov 5, 2023 · 0 comments
Open
Labels
backend Relates to backend enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed

Comments

@fisher60
Copy link
Member

fisher60 commented Nov 5, 2023

Summary

Callback URIs can be set to any arbitrary value, including relative paths or just nonsense. Currently the AbandonAuth UI for developer dashboards uses a relative path for the callback URI. This should be changed to use the full URL in the specific environment. I.e in production we should be using auth.abandontech.cloud/ui, in dev it should use localhost:{port}/ui where port is the actual port the application is being locally deployed with.

Acceptance Criteria

Callback URIs have validation either in the database, Pydantic models, or both that forces them to be in the form of a valid URI, therefore disallowing relative paths or random strings.
The AbandonAuth UI must also use the new, correct format for its own redirect to the AbandonAuth login page.

@fisher60 fisher60 added enhancement New feature or request good first issue Good for newcomers labels Nov 5, 2023
@fisher60 fisher60 added this to the Initial Release milestone Nov 5, 2023
@fisher60 fisher60 added the help wanted Extra attention is needed label Feb 4, 2024
@fisher60 fisher60 added the backend Relates to backend label Apr 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backend Relates to backend enhancement New feature or request good first issue Good for newcomers help wanted Extra attention is needed
Projects
None yet
Development

No branches or pull requests

1 participant