Allow for Single sign-on (SSO) using JWT token
L
Literary Amphibian
The current documentation for identifying and redirecting relies on client side code executing: https://help.canny.io/getting-started-on-canny/setting-up-single-sign-on-redirect
This poses a potential security risk since anything on the client can be manipulated including the data that is being sent in the identify method.
My login page is a native form post which means that after I authenticate my user I need to load a new page just to run the canny script to redirect them.
My proposed feature is the ability to generate a JWT token for redirection purposes. Once authentication happens on my backend I can redirect the user to something like https://my-company.canny.io/auth/jwt={generatedJwtTokenHere}&redirect=https://feedback.my-company.com
This is how our SSO implementation with Zendesk works. You can find their documentation here: https://support.zendesk.com/hc/en-us/articles/203663816-Enabling-JWT-JSON-Web-Token-single-sign-on#topic_w5x_1fh_3fb
In addition I feel the documentation should be updated to warn users of potential unvalidated redirect attacks: https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet
Please do let me know if I overlooked any documentation about how to achieve my suggestion above.
Thanks
Andrew Rasmussen
Hey Nick! Thanks for posting this.
You have two options for more secure SSO:
- Redirect the user with a JWT token (as you describe).
If you follow the docs to generate an SSO token, and then redirect the user to https://feedback.your-company.com/any/path?ssoToken={generatedJwtTokenHere}, they will be authenticated.
The downside of this approach is that you can currently only pass the following user fields: id, name, email, avatarURL.
- Secure our client-side SDK with a server-generated hash.
We can set a toggle on your account so that we only accept client-side identify requests if they include a server-generated hash.
To generate the hash, simply HMAC-SHA256 their userID (in hex), like this:
https://gist.github.com/arasmussen/44f33a3fafbaea53da30f76295e85925
As of writing, neither of these options are publicly documented yet, so I'm glad you reached out! Let us know if you have any questions.