[B2C Mode] Web UI Security Issues
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- android, java
- Domain
- authentication, mobile, security
Research direction
No files or tests are named. Start by running the Sample App, selecting B2C Mode, and using RUN USER FLOW to reproduce the exposed URL; then trace the Android Web UI integration. Done should mean the URL is no longer exposed as reported, or the requested WebView customization or hiding behavior is clearly defined and verified.
Written by the indexing model from the issue text.
Description
[B2C Mode] Web UI Security Issues
This issue is for a: (mark with an x)
- [ ] bug report -> please search issues before submitting
- [x] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
Minimal steps to reproduce
- Start Sample App
- Select "B2C Mode"
- Click "RUN USER FLOW"
- Loading Web UI
Any log messages given by the failure
Expected/desired behavior
URL exposed, causing security issues
ex) https://fabrikamb2c.b2clogin.com/tfp/fabrikamb2c.onmicrosoft.com/b2c_1_susi/oAuth2/v2.0/authorize?x-client-CPU=**arm64-v8a**&response_type=code&x-client-Ver=1.5.9&code_challenge_method=S256&x-client-DM=**SM-N986N**&hsu=1&x-client-OS=30&x-client-SKU=MSAL.Android&client_id=#client_id#&login_hint=k%40nav.com&ui_locales=ko-kr&client-request-id=#client-request-id#&instance_aware=false&scope=https%3A%2F%2Ffabrikamb2c.onmicrosoft.com%2Fhelloapi%2Fdemo.read%20openid%20offline_access%20profile&redirect_uri=msauth%3A%2F%2Fcom.azuresamples.msalandroidapp%2F1wIqXSqBj7w%252Bh11ZifsnqwgyKrY%253D&state=YzE4YmM0YzAtNmQ1ZC00ZjMzLTlhMWUtNjg3NzhmOTQ1YzFiLTQ4MjJmMWQ3LTRhYWQtNDQ3Ni05MjcxLWEyZWU1NDYzM2RkYw&code_challenge=ygCZXOVy6zSTQhNUAJ0vOdmIu7WnYBSr4JjQGLOf0JE
OS and Version?
Android 5~11+
Versions
targetSdkVersion 26~ 30 +
Mention any other details that might be useful
Currently, the Web UI has a security vulnerability because the URL is exposed as it is.
It is possible to customize the webview, or I need the ability to hide the URL or function.
Thanks! We'll be in touch soon.
- Dominant language
- Java
- Stars
- 34
- Forks
- 30
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Azure-Samples/ms-identity-android-java
-
Difficulty 2/5 1-3 hours Newbie friendliness 55/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
Azure-Samples/ms-identity-android-java#57 · 2 comments ·
-
ADAL packages Open
Difficulty 2/5 1-3 hours Newbie friendliness 35/100
-
Difficulty 4/5 3-5 days Newbie friendliness 20/100
-
Difficulty 5/5 Over a week Newbie friendliness 15/100
All issues in Azure-Samples/ms-identity-android-java
Similar issues
-
area-deployment area-integrations triage:bot-seen
Difficulty 2/5 Half a day Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
apache/flink-agents#1156 ·
-
[source-shopify] FAILED bulk operation without partialDataUrl is silently treated as successful Openarea/connectors autoteam community connectors/source/shopify needs-triage team/use type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100