You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We also need to support a white list for the client field, as of right now it can be anything as configured in the client.
We also need a separate environment variable on the client side to determine if we must use the currently deployed front-end for export. This can be true only for the testing environment.
The PDF export could have a security vulnerability as explained in https://blog.projectdiscovery.io/abusing-reverse-proxies-metadata/
I suggest we also refactor the export endpoint as following
The client sends only the following information
The server should have a static configuration to save information regarding exports
For example
/dref-applications/{}/export
.... and others
client
field, as of right now it can be anything as configured in the client.true
only for thetesting
environment.The PDF export could have a security vulnerability as explained in https://blog.projectdiscovery.io/abusing-reverse-proxies-metadata/
cc @thenav56
The text was updated successfully, but these errors were encountered: