Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CAL-3362] Use tokens for public mutating endpoints #14342

Open
zomars opened this issue Apr 4, 2024 · 0 comments · May be fixed by #14946
Open

[CAL-3362] Use tokens for public mutating endpoints #14342

zomars opened this issue Apr 4, 2024 · 0 comments · May be fixed by #14946
Labels
✨ feature New feature or request foundation Medium priority Created by Linear-GitHub Sync security

Comments

@zomars
Copy link
Member

zomars commented Apr 4, 2024 •
edited 

          For a follow up. Generate a token from the email and verify it to avid exposing mutations publicly. Similarly on how we do for confirmation emails:

cal.com/packages/emails/src/templates/OrganizerRequestEmail.tsx

Lines 8 to 11 in 386968f

const seedData = { bookingUid: props.calEvent.uid, userId: props.calEvent.organizer.id };
const token = symmetricEncrypt(JSON.stringify(seedData), process.env.CALENDSO_ENCRYPTION_KEY || "");
//TODO: We should switch to using org domain if available
const actionHref = `${WEBAPP_URL}/api/link/?token=${encodeURIComponent(token)}`;

Originally posted by @zomars in #14215 (comment)

CAL-3362
@zomars zomars changed the title Use tokens for public mutating endpoints [CAL-3362] Use tokens for public mutating endpoints Apr 4, 2024
@dosubot dosubot bot added security ✨ feature New feature or request labels Apr 4, 2024
@alishaz-polymath alishaz-polymath mentioned this issue Apr 12, 2024
Merged
@zomars zomars added Medium priority Created by Linear-GitHub Sync foundation labels Apr 30, 2024
@anikdhabal anikdhabal linked a pull request May 8, 2024 that will close this issue
Draft
3 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
✨ feature New feature or request foundation Medium priority Created by Linear-GitHub Sync security
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: use tokens for public mutating endpoints anikdhabal/cal.com
1 participant
@zomars