But PZH page where we do login, it will not be installed/permitted apps. 

 

From: John Lyle [mailto:notifications@github.com] 
Sent: 07 June 2013 10:48
To: webinos/webinos-pzp
Cc: Habib Virji
Subject: Re: [webinos-pzp] System test/ synchronization and remove friendlyName (#21)

 

In lib/pzp_receiveMessage.js:

> +                PzpObject.handleProcessedMessage(validMsgObj, conn);
> +            });
> +        } catch (err) {
> +            PzpObject.emit("EXCEPTION", new Error("failed in processing message received" + err));
> +        } finally {
> +            conn.resume ();// unlocks socket.
> +        }
> +    };
> +
> +    this.handleProcessedMessage = function(validMsgObj, conn) {
> +        logger.log ("msg received " + JSON.stringify (validMsgObj));
> +        if (PzpObject.checkConnectedPzh(validMsgObj.from)    || // Currently Connected PZH
> +            PzpObject.checkConnectedPzp(validMsgObj.from)    || // Currently Connected PZPs
> +            PzpObject.checkConnectedWebApp(validMsgObj.from) || // Currently Connected PZH
> +            validMsgObj.payload.status === "registerBrowser" || // Special exception as this is first msg from browser
> +            expectedPzhAddress                               || // Enrollment message comes from this address

Admittedly, we aren't stopping this at the moment, but it's something we should add in the future - validating the origin of the websocket against a list of installed/permitted apps.

—
Reply to this email directly or view it on GitHub <https://github.com/webinos/webinos-pzp/pull/21/files#r4585655> .  <https://github.com/notifications/beacon/XUg7godVN2O0jV1-5T0xO9NSB5W6rANo54spR6MQzO5RsvUzPYxpjHrlVPu0KcZl.gif>