-
Notifications
You must be signed in to change notification settings - Fork 189
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
HttpInterceptor Tokens Leak on CORS requests and break CORS. #504
Comments
Not sure the best way to fix this, but the default configuration is insecure and breaks CORS requests where servers do not accept the headers which are being added to the request. In my case, I cannot change the API base to a specific URL because we are deploying the same code across different subdomains. Also, setting the API base at runtime has implications for AOT compilation. I think the default configuration should be that if a request is to a host on a different domain that a flag has to be set to specifically enable CORS authentication. Alternatively, having a blob type check for whitelist and blacklisting of URLS might work. Would be interested to hear the thoughts on this. |
I'm submitting a...
Current behavior
AngularTokenInterceptor sends headers to outside domain (CORS) when apibase is null or blank. This breaks CORS requests.
https://github.com/neroniaky/angular-token/blob/master/projects/angular-token/src/lib/angular-token.interceptor.ts#L23
Expected behavior
AngularTokenInterceptor should not use match test when apiBase configuration is blank or null. This breaks CORS requests running through the pipeline and also leaks data to outside servers.
What is the motivation / use case for changing the behavior?
Environment
Angular-Token version: 6.0.4 (still an issue in current)
Angular version: 7.0.3
Bundler
Browser:
Others:
Not sure the best way to fix this, but there needs to be some way to prevent tokens from being appended to every request going through the pipeline when the api base is set to "" which will be the default in 95% of cases.
The text was updated successfully, but these errors were encountered: