Re: Address proxied content forging with new query parameter

[Adam Winer]

Done, new patch uploaded.

On Tue, Mar 31, 2009 at 2:37 PM, <bea...@google.com> wrote:
>
> http://codereview.appspot.com/32091/diff/1/2
> File draft/Gadgets-API-Specification.xml (right):
>
> http://codereview.appspot.com/32091/diff/1/2#newcode677
> Line 677: to distinguish proxied content renders from
> gadgets.io.makeRequest() calls.
> How about:
>
> Remote sites that expect proxied content requests SHOULD reject requests
> that do not have opensocial_proxied_content set to 1.  If a remote site
> fails to implement this check, any content in the POST body may be
> spoofed by a malicious user or application.
>
> http://codereview.appspot.com/32091
>

[Adam Winer]

Any objections to the patch as is?  Or +1s?

2009/3/31 Adam Winer <awi...@gmail.com>

[Brian Eaton]

+1

2009/4/1 Adam Winer <awi...@gmail.com>:

[Chris Chabot]

+1 and i've implemented it in php-shindig too

2009/4/1 Adam Winer <awi...@gmail.com>

[Evan Gilbert]

+1

[Louis Ryan]

+1

[Scott Seely]

Ok.+1

[Arne Roomann-Kurrik]

Looks good - I've committed this at http://code.google.com/p/opensocial-resources/source/detail?r=1079

~Arne

--
OpenSocial IRC - irc://irc.freenode.net/opensocial