diff options
| author | Bernhard Posselt <dev@bernhard-posselt.com> | 2016-05-10 22:02:10 +0200 |
|---|---|---|
| committer | Bernhard Posselt <dev@bernhard-posselt.com> | 2016-05-10 22:02:10 +0200 |
| commit | 79098ac72525b03c34587819fd46f3f9c7e7792b (patch) | |
| tree | bcdb310dd11ae88598b2545ba04e80ce3756eba7 /docs | |
| parent | d439cbf9b6605900c55700c0fe4582871f62f716 (diff) | |
More security guidlines
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/developer/External-Api.md | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/docs/developer/External-Api.md b/docs/developer/External-Api.md index 996b2233b..40a548a86 100644 --- a/docs/developer/External-Api.md +++ b/docs/developer/External-Api.md @@ -156,6 +156,7 @@ Read the following notes carefully to prevent being subject to security exploits * All string fields in a JSON response **expect an item's body** are **not sanitized**. This means that if you do not escape it properly before rendering you will be vulnerable to [XSS](https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29) attacks * Basic Auth headers can easily be decrypted by anyone since base64 is an encoding, not an encryption. Therefore only send them if you are accessing an HTTPS website or display an easy to understand warning if the user chooses HTTP * When creating a feed you can choose to add basic auth authentication credentials. These must be stored in clear text so anyone with access to your database (however they might have achieved it, think of Sql injection) can read them and use them to access the website. You should warn the user about this. +* If you are building a client in JavaScript or are using a link with **target="blank"**, remember to set the **window.opener** property to **null** and/or add a **rel="noreferrer"** to your link to prevent your app from being [target by an XSS attack](https://medium.com/@jitbit/target-blank-the-most-underestimated-vulnerability-ever-96e328301f4c#.wf2ddytbh) ## Syncing All routes are given relative to the base API url, e.g.: **/sync** becomes **https://yourowncloud.com/index.php/apps/news/api/v2/sync** |