I am currently working on a messaging system that integrates GoogleDrive and OneDrive links as attachments. I am using the Google and OneDrive filepickers to obtain the links to be attached, which are then sent to the application API to be persisted.
However, it is possible for an attacker to change the payload to a maclious URL before request is sent. This could be used for phishing attacks.
My question is: is there any way to validate that links are actually from OneDrive/Google Drive?
The solution supports links from Google Drive, OneDrive as well as Sharepoint and OneDrive for business.