What problem did you meet?
With the pre load function, metadata about config is disclosed in the html when you hit any logTo page.
Because of this if you have entered any information on an SSO Connectors display settings eg display name or added a custom image for the SSO flow / branding. This information is disclosed. It is not advised on this part of the SSO page that doing so would disclose the displayName or orgLogos to anybody that traverses the website, without any validation or requirements.
"ssoConnectors": [{ "id": "{{ssoId}}", "connectorName": "{{ssoDisplayName}}", "logo": "{{ssoOrgLogo}}", "darkLogo": "{{ssoDarkOrgLogo}}" }]
as a bad actor, if configured unintentionally. I am able to ascertain what org use this particular application, giving me additional information to use as part of a phishing / attack campaign.
Describe what you'd like Logto to have
Minimum, disclosure that on the SSO connector part of the display page any information populated would be visible. (Reduce exposure of customers/users if display config populated without prior knowledge that this is rendered, avoids configuration mistakes disclosing names of org's using that platform)
Domain-gated SSO discovery (revealing a connector only after a matching email domain is entered).
What problem did you meet?
With the pre load function, metadata about config is disclosed in the html when you hit any logTo page.
Because of this if you have entered any information on an SSO Connectors display settings eg display name or added a custom image for the SSO flow / branding. This information is disclosed. It is not advised on this part of the SSO page that doing so would disclose the displayName or orgLogos to anybody that traverses the website, without any validation or requirements.
"ssoConnectors": [{ "id": "{{ssoId}}", "connectorName": "{{ssoDisplayName}}", "logo": "{{ssoOrgLogo}}", "darkLogo": "{{ssoDarkOrgLogo}}" }]as a bad actor, if configured unintentionally. I am able to ascertain what org use this particular application, giving me additional information to use as part of a phishing / attack campaign.
Describe what you'd like Logto to have
Minimum, disclosure that on the SSO connector part of the display page any information populated would be visible. (Reduce exposure of customers/users if display config populated without prior knowledge that this is rendered, avoids configuration mistakes disclosing names of org's using that platform)
Domain-gated SSO discovery (revealing a connector only after a matching email domain is entered).