Closed

Security vulnerability. #8523

ahmedelkady created 3 months ago

ABP Framework version: v9
UI Type: Angular / MVC / Blazor WASM / Blazor Server
Database System: EF Core (SQL Server)
Tiered Auth Server Separated (for Angular): yes
Exception message and full stack trace:
Steps to reproduce the issue: when calling api/abp/application-configuration?includeLocalizationResources=false it shows sensitive settings such as "Abp.Identity.OAuthLogin.ClientSecret":"our-outh-secret" which is a very high vulnerability can you please guide us how solve this and why this is happening also there is too much information which shouldn't be exposed that easy. even the secret is stored as a plain text in AbpSettings!.

1 Answer(s)

liangshiwei created 3 months ago

Support Team Fullstack Developer

Hi,

We will fix it immediately. your ticket was refunded.

You can use this temporary solution:

public class TestAppSettingDefinitionProvider : SettingDefinitionProvider
{
    public override void Define(ISettingDefinitionContext context)
    {
        var secret = context.GetOrNull(IdentityProSettingNames.OAuthLogin.ClientSecret);
        secret.IsVisibleToClients = false;
    }
}