Skip to content
This repository has been archived by the owner on Mar 8, 2024. It is now read-only.

Validate that PayID domain matches server domain on creation #669

Open
nkramer44 opened this issue Aug 20, 2020 · 1 comment
Open

Validate that PayID domain matches server domain on creation #669

nkramer44 opened this issue Aug 20, 2020 · 1 comment

Comments

@nkramer44
Copy link
Collaborator

Currently in the admin API, you can create a PayID which has a different domain than the domain of the PayID server without the server complaining. However, that PayID is now useless because any PayID query with the configured account will return a 404.

Detailed Description

Let's say I want to create a PayID nkramer$example.com on the PayID server locally. I could do that by hitting http://localhost8081/users with this payload:

{
    "payId": "nkramer44$example.com",
    "addresses": [
        {
            "paymentNetwork": "XRPL",
            "environment": "TESTNET",
            "details": {
                "address": "rE2L8SciZFHP4UX8ZWJxobeuaPTe7EShBq"
            }
        }
    ]
}

The PayID server will store the PayID nkramer44$example.com. If I then take my username nkramer44 and do a PayID lookup like GET http://localhost:8080/nkramer44, I will get a 404 because the server will look for a PayID like nkramer44$localhost.

Context

This isn't a huge deal, because someone playing around with the server locally or in the sandbox could just delete the incorrect PayID, but in the interest of making this thing as fool proof as possible, I think new users would benefit from some error feedback in this case.

Possible Implementation

In the users.ts middleware, we could just do a simple check on the payload PayID to compare it to the server domain.

Alternatives Considered

Additional Context

Bonus

Are you willing to submit a pull request to implement this change?

@dangell7
Copy link
Contributor

Yes, when you work in dev env, EVERYTHING must be "localhost".

I'm learning this as well.

The thought here is "What is the domain"?

If you are creating a payID, on a localhost, the domain is in fact, "localhost". lol

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants