VirtoCommerce/vc-community — pull request #3 by MarkOGDev (2014-05-06 14:54:20+00:00)
Title: Multiple host names fix

If your website has multiple hostnames then you can have problems connecting the Manager to the Website.
You can only connect to the First (default) hostname.

E.g.
Hostname 1: testname
Hostname 2: virtotest

You can connect Virto Manager to 'testname' but not to 'virtotest'
I have made a small change that makes the code work for any host name including I.P. addresses.

Changed Namespace = VirtoCommerce.Web.Client.Services.Security
Changed File name = OAuthAuthorizationManager.cs
Changed Method Name = CheckAccessCore

The current way we get 'requestUri' only gets the default url of the service (i.e. the url using the first hostname).
I have changed way we get 'requestUri' to get the url of the incoming request.

I understand that the code checks the Audience(Scope) and the RequestUri in order to make the service more secure but I am not 100% about this mechanism.
I am hoping that my change is not opening the service up to any attacks.

What do you guys think about my code change?

Also I have seen that there is a problem if you use an upper case host name.
This could easily be fixed but setting the two urls to lower case before they are compaired.
I can add that code if you think it is a good idea?