SeaweedbrainCY / zero-totp / 26850636017

push

github

feat(api): If the detected Origin is likely a mobile app, tokens are also returned in the body

The Origin header is used to know if the origin app is capacitor or not. This header is spoofable, but only on a hijacked browser. Innocent user cannot have this modified without a compromised browser.
Attacker can spoof their own Origin header. In that case there is no sensitive information that isn't already transmitted in the SetCookies header.

It's more a precaution feature than a security feature

9 of 15 new or added lines in 1 file covered. (60.0%)

13609 of 14749 relevant lines covered (92.27%)

0.92 hits per line