Joshua, We use relatively specific regexes for our services (and use order to place more general regexes later in the list). The advantage being service specific configuration (including metadata; like contact person, description, etc.). The cost being more services to manage. Cas will read the services list about every minute or more frequently. So newly added services will be picked up quickly.
Robert's point on look-a-like domains is a good one. Ray On Wed, 2023-02-15 at 10:46 -0800, Joshua Leger wrote: Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information. Hello, I have recently taken over the CAS instance at my university and have a question about security for the regex in CasRegisteredService. My understanding is that you wouldn't want to set up a service with a serviceId of "^https://.+"; because an attacker could make a fake website that seems legitimate because it uses our actual CAS server to authenticate and then convinces the user to input sensitive information. If my university owns the university.edu domain though, could I set up a regex like "^https?://[^/]*university\.edu/.*" that allows all subdomains safely because an attacker couldn't make their own subdomain that they control? Are there any other risks of the "^https://.+"; serviceId that I haven't thought of? Thanks! -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/319a6288c210f2cd4f51cf1ec7f278ab5bf1ade5.camel%40uvic.ca.
