Closed Bug 1028765 Opened 11 years ago Closed 8 years ago

FxA's HTTP client should sanitize email addresses sent from the server

Categories

(Firefox :: Firefox Accounts, defect)

Product:
Firefox
Component:
Firefox Accounts
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WONTFIX

People

(Reporter: spenrose, Unassigned)

References

Details

The Firefox Accounts Authentication server can return 400/120 indicating that the email address submitted by the client was correct except for case. The server will include the canonical spelling. To prevent injection attacks by a compromised server, the HTTP client should sanitize that "canonical" value.
If the client knows the email address it submitted, can it simply compare the value returned by 400/120 for case-sensitive equality? If it can, should it?
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → WONTFIX
Product: Core → Firefox
You need to log in before you can comment on or make changes to this bug.