Jeff Young created SLING-2572:
---------------------------------
Summary: Redirect validating service
Key: SLING-2572
URL: https://issues.apache.org/jira/browse/SLING-2572
Project: Sling
Issue Type: Improvement
Components: General
Reporter: Jeff Young
Clients need to validate redirects to esure that they point on-site (or perhaps
to an authority on a white-list) to prevent phishing attacks. A Sling service
which performed this would allow consistency (and a single point of extension).
There already exists AuthUtil.isRedirectValid() [0], but it doesn't handle URLs
(only paths), and disallows relative paths (the second of which, at least, is
widely used).
There is also a referrer validating service [1] which might provide a better
starting point.
Lastly, if we had backward-compatibility concerns with some of the algorithms
encoded in those methods/services, we might choose to provide a very basic
default implementation which simply drops any scheme and/or authority from the
URL, and let customers do white-lists and/or other more sophisticated checks as
customizations.
References:
[0]
https://svn.apache.org/repos/asf/sling/trunk/bundles/auth/core/src/main/java/org/apache/sling/auth/core/AuthUtil.java
[1]
https://svn.apache.org/repos/asf/sling/trunk/contrib/extensions/security/impl/ReferrerFilter.java
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
