External WebId security issue

Open
#1,597 2 comments 0 reactions 1 assignee View on GitHub

@bourgeoa is already working on this.

Since Mar 8, 2022.

Assessment

This issue has not been assessed yet.

Description

Tim Berners-Lee @timbl mai 14 16:11
Intersting: Trying to register a new account with an external webid I get an nmessage saying linked acounts are not supported?

Alain Bourgeois @bourgeoa mai 14 16:18
@timbl it has been removed by @michielbdejong and I don't now why solid/node-solid-server#1566

Tim Berners-Lee @timbl mai 14 16:40
I assume it was a security thing? I wonder how many accountes there are with linked owners

Tim Berners-Lee @timbl mai 14 16:46
Anyone else know?

Michiel de Jong @michielbdejong 09:27
Yes, it was a security thing. We can only re-activate it if we fix the way aliases work, first. With the current code, it was possible to steal any existing username on the same server and make it a local alias of the newly created account. So you would need to add a check to make sure the external webid is not local!

@michielbdejong
Is aliases owl:sameAs ?
Is the security issue related to CORS ?

Dominant language
JavaScript
Stars
1.8k
Forks
308
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nodeSolidServer/node-solid-server

All issues in nodeSolidServer/node-solid-server

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.