I hope this is obvious, but I wanted to get it out there because of how important it is.

If your client allows user-entered Lemmy instances, ALWAYS verify that the instance is a valid Lemmy instance before sending credentials over. Otherwise, the user may have entered a url to an unknown server or site, and you will be sending their login credentials to a server that may be logging and storing the request or even intentionally trying to capture these credentials.

Instead, call getSite at the very least, or use a public list of verified servers before making the login request.

I would not be surprised if down the road malicious sites with similar domains to popular instances will be created to get login details of users who mis-typed their instance domain. It’s partially our responsibility to make sure our users are safe, so let’s keep this discussion going as we learn new ways to handle security concerns!

No comments yet!

Lemmy App Development

!lemmydev@lemm.ee

Create post

A place for Lemmy builders to chat about building apps, clients, tools and bots for the Lemmy platform.

On-Topic:

  • programming questions related to the Lemmy platform
  • sharing your ideas, WIP, or released Lemmy-related work

Off-Topic:

  • general programming questions unrelated to Lemmy
  • feature requests for developers
  • sharing or promoting work not related to Lemmy

Community stats

  • 18

    Monthly active users

  • 57

    Posts

  • 21

    Comments

Community moderators