Also be very careful with your regex, it could open you up to pseudo-similar domain name exploit.
eg. https://anotheruniversity.edu << allow malicious pseudo-similar domain VS https://my.university.edu << allow child domains I’d suggest changing it to “^https?://([^/]*\.)?university\.edu/.*”, but only if you are set on a wild card service entry for your domain. I would caution against it though. From: [email protected] <[email protected]> On Behalf Of Joshua Leger Sent: Wednesday, February 15, 2023 3:16 PM To: CAS Community <[email protected]> Subject: [EXTERNAL SENDER] [cas-user] Security question about CasRegisteredService wildcards Hello, I have recently taken over the CAS instance at my university and have a question about security for the regex in CasRegisteredService. My understanding is that you wouldn't want to set up a service with a serviceId of "^https://.+"; because an attacker could make a fake website that seems legitimate because it uses our actual CAS server to authenticate and then convinces the user to input sensitive information. If my university owns the university.edu domain though, could I set up a regex like "^https?://[^/]*university\.edu/.*" that allows all subdomains safely because an attacker couldn't make their own subdomain that they control? Are there any other risks of the "^https://.+"; serviceId that I haven't thought of? Thanks! -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/9d329790-70fd-4e84-b22d-29a3192cd304n%40apereo.org<https://groups.google.com/a/apereo.org/d/msgid/cas-user/9d329790-70fd-4e84-b22d-29a3192cd304n%40apereo.org?utm_medium=email&utm_source=footer>. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/5d525b67b57d4a77a66b577d393a4059%40mun.ca.
