SeaweedbrainCY / zero-totp / 26850636017

92%

main: 92%

Build Type

push

github

Committed by SeaweedbrainCY

Commit Message

feat(api): If the detected Origin is likely a mobile app, tokens are also returned in the body

The Origin header is used to know if the origin app is capacitor or not. This header is spoofable, but only on a hijacked browser. Innocent user cannot have this modified without a compromised browser.
Attacker can spoof their own Origin header. In that case there is no sensitive information that isn't already transmitted in the SetCookies header.

It's more a precaution feature than a security feature

Coverage Stats

9 of 15 new or added lines in 1 file covered. (60.0%)

52 existing lines in 1 file now uncovered.

13609 of 14749 relevant lines covered (92.27%)

0.92 hits per line