edk12564 opened a new issue, #113: URL: https://github.com/apache/fineract-consumer-facing/issues/113
Sensitive actions (transfer, add/update beneficiary, password change) use a two-phase step-up: *initiate* issues a short-lived JWT, *confirm* verifies it. The token is pinned to one specific action via an "action fingerprint". At confirm, the fingerprint is recomputed from the incoming request and compared (`StepUpTokenService.java:91-102`). Correctness depends entirely on initiate and confirm producing **byte-identical** strings. The problem is that there are multiple device fingerprint check overloads. And each overload will produce different fingerprint strings. We dodge this issue in Beneficiaries and Users by using a single device fingerprint helper that calls the same overload. However, transfers does not. Also, future maintainers could end up using the wrong overload, resulting in issues. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
