From 9696fde67637a1f2e4fe5b7148358430b520fc62 Mon Sep 17 00:00:00 2001 From: Livio Spring Date: Mon, 9 Oct 2023 13:08:18 +0300 Subject: [PATCH] fix: reduce origin check to tokens issued through code and implicit flow (#6681) fix: only check origin for tokens issued to users through apps (code / implicit flow) --- internal/api/authz/context.go | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/internal/api/authz/context.go b/internal/api/authz/context.go index ec2e13d0e..bfdd648fe 100644 --- a/internal/api/authz/context.go +++ b/internal/api/authz/context.go @@ -78,9 +78,12 @@ func VerifyTokenAndCreateCtxData(ctx context.Context, token, orgID, orgDomain st if err != nil { return CtxData{}, errors.ThrowPermissionDenied(err, "AUTH-GHpw2", "could not read projectid by clientid") } - } - if err := checkOrigin(ctx, origins); err != nil { - return CtxData{}, err + // We used to check origins for every token, but service users shouldn't be used publicly (native app / SPA). + // Therefore, mostly won't send an origin and aren't able to configure them anyway. + // For the current time we will only check origins for tokens issued to users through apps (code / implicit flow). + if err := checkOrigin(ctx, origins); err != nil { + return CtxData{}, err + } } if orgID == "" && orgDomain == "" { orgID = resourceOwner