synapse-product/8275.feature at 6d2d42f8fb04599713d3e6e7fc3bc4c9b7063c9a - synapse-product - Gitea: Git with a cup of tea

Matrix-Mirrors/synapse-product

mirror of https://git.anonymousland.org/anonymousland/synapse-product.git synced 2024-12-21 02:54:19 -05:00

Andrew Morgan 094896a69d

Add a config option for validating 'next_link' parameters against a domain whitelist (#8275 )

This is a config option ported over from DINUM's Sydent: https://github.com/matrix-org/sydent/pull/285

They've switched to validating 3PIDs via Synapse rather than Sydent, and would like to retain this functionality.

This original purpose for this change is phishing prevention. This solution could also potentially be replaced by a similar one to https://github.com/matrix-org/synapse/pull/8004, but across all `*/submit_token` endpoint.

This option may still be useful to enterprise even with that safeguard in place though, if they want to be absolutely sure that their employees don't follow links to other domains.

2020-09-08 16:03:09 +01:00

1 line

132 B

Gherkin

Raw Blame History

Add a config option to specify a whitelist of domains that a user can be redirected to after validating their email or phone number.