1023296 - Use app:// scheme as audience for verification of assertions coming from the FxOS client

Status: VERIFIED FIXED

(Hello (Loop) :: Server, defect)

Description

[Fernando Jiménez Moreno [:ferjm]]

FxOS privileged apps are able to set a custom origin in their manifest, however they are still tied to the app:// scheme. On the other hand, FxAccounts and MobileID assertions has their audience set to the origin of the requester app by default. If the Loop server verifies an assertion coming from the FxOS client with the https URL, it will fail. So we need to make the scheme change in the server iff only the scheme defers from the expected origin.

Comment 1

[Alexis Metaireau (:alexis)]

Attachment: link to github PR

Comment 2

[José Antonio Olivera Ortega [:jaoo]]

Comment on attachment 8438292 [details] [review]
link to github PR

Works like a charm. Thanks for adding this.

Comment 3

[Alexis Metaireau (:alexis)]

https://github.com/mozilla-services/loop-server/commit/9d915967a9f6b4a19c655b76fc79379aa2343b6c

Comment 4

[Chris Karlof [:ckarlof]]

Comment on attachment 8438292 [details] [review]
link to github PR

I'd prefer a different approach to allow app:// audiences for the loop server. At the least, it would be nice if it uses a URL parsing library as opposed to a regex. Even better would be to restructure the code to pass in the specific app:// audience when you know it's being used.

Manually parsing the assertion for these purposes is a bit of an anti-pattern and I would avoid it if you could. A bug in this logic could cause you to accept whatever audience is specified by the assertion.

https://github.com/mozilla-services/loop-server/pull/99#discussion-diff-13664348

Comment 5

[Alexis Metaireau (:alexis)]

Thanks for the feedback! See https://github.com/mozilla-services/loop-server/pull/105 for a different approach.

Comment 6

[Alexis Metaireau (:alexis)]

https://github.com/mozilla-services/loop-server/commit/01abec3f24c407238d3746f9380298cc2d7b9da2

Comment 7

[James Bonacci [:jbonacci]]

Verified in code in through unit tests.