I am currently working on a messaging system that integrates GoogleDrive and OneDrive links as attachments. I am using the Google and OneDrive filepickers to obtain the links to be attached, which are then sent to the application API to be persisted.

However, it is possible for an attacker to change the payload to a maclious URL before request is sent. This could be used for phishing attacks.

My question is: is there any way to validate that links are actually from OneDrive/Google Drive?

The solution supports links from Google Drive, OneDrive as well as Sharepoint and OneDrive for business.

  • whitelist the domain part? – Vipul Nair Jul 3 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.