feat(#479): set returnUrl in requests #499
Conversation
Zonnex
force-pushed
the
feature/479-returnUrl
branch
from
58bde17 to
21d461b
Compare
…depending on device, os, etc. This logic is currently used when setting the return url as part of the auto launch url and should be applied when sending the return url to bankid as part of the auth, sign or payment request as well.
… constructor with the return url.
Liteolika
left a comment
Liteolika
left a comment
There was a problem hiding this comment.
The security of the returnUrl feature relies entirely on correct implementation by library users. The potential main risk is improper validation of returnUrl and nonce by downstream developers which may expose open redirect or replay vulnerabilities.
A automated safeguard and/or validation of the returnUrl could be a future feature.
|
@Liteolika You're correct that this is a potential concern. In many scenarios (depending on device and OS), Active Login deliberately clears the returnUrl and replaces it with an empty string. This is required for the flow to work: the BankID app closes, and the user returns to the application in the background. Because of this behavior, having Active Login attach a nonce to the returnUrl isn’t straightforward. That said, I agree this is an area worth revisiting, and we should explore potential improvements in the future. |
This PR fixes first part of #479, to assign the returnUrl for the AuthRequest/SignRequest we send to BankId. This URL takes precedence over the returnUrl given in the AutoStart functionality.