fix(core): process POST requests for institutions solely on ROR #25

New issue

Closed

opened 2025-07-28 09:07:57 +00:00 by chartgerink · 0 comments

chartgerink commented

2025-07-28 09:07:57 +00:00

Owner

We currently process institutions in a way that trusts the client-side provided information. In other words, the POST request body may look like:

{
  "ror": "some-ror",
  "name" "with a fake name"
}

As a result, this is an attack vector to change the institution names. If we only process the ROR, we can add all the metadata in a more reliable manner on the back end ourselves. Any institution that does not have a ROR, will have to be added separately (for example, by an admin directly).

We currently process institutions in a way that trusts the client-side provided information. In other words, the POST request body may look like: ```json { "ror": "some-ror", "name" "with a fake name" } ``` As a result, this is an attack vector to change the institution names. If we only process the ROR, we can add all the metadata in a more reliable manner on the back end ourselves. Any institution that does not have a ROR, will have to be added separately (for example, by an admin directly).