sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-07 22:19:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Submit login credentials URL-encoded and accept them only in that encoding, so AppSec can redact them

Browse Source
This commit is contained in:
Viktor Liu
2026-09-23 13:09:03 +02:00
parent d77091cdbe
commit 469973f59d
4 changed files with 81 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy/web/dist/assets/index.js
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
proxy/web/src/App.tsx
+6 -4
View File
@@ -52,16 +52,18 @@ function App() {
setError(null);
setSubmitting(method);
const formData = new FormData();
// URL-encoded, not FormData: the proxy only accepts credentials in this
// encoding, the one it can redact before mirroring a request to AppSec.
const body = new URLSearchParams();
if (method === "password") {
formData.append(methods.password!, value);
body.append(methods.password!, value);
} else {
formData.append(methods.pin!, value);
body.append(methods.pin!, value);
}
fetch(globalThis.location.href, {
method: "POST",
body: formData,
body,
redirect: "manual",
})
.then((res) => {