NAA - brk-multihub domain security implications

[malnoxon]

I'm having trouble wrapping my head around the security implications of the new brk-multihub://www.mydomain.com SPA redirect URI needed for NAA.

Say we host our addin code on some shared service so while https://company1.mydomain.com/auth.html is guaranteed to be owned by us, https://company2.mydomain.com/otherpath.html may not be. Would adding brk-multihub://www.mydomain.com as an SPA redirect URI open us up to security risks from other users of the shared domain? (my assumption is that the answer is yes, but I'm struggling to understand exactly what they would be and would like to understand better before we do the work to move our code to a domain we fully control).

[guodd1]

Thank you for reaching out regarding the security implications of the brk-multihub://www.mydomain.com redirect URI.

Office Add-ins are standard web applications, and we are not security experts. As such, we are unable to provide guidance on the security design or risk assessment of your implementation. We recommend consulting your organization’s security team or a security specialist to evaluate your specific scenario and ensure it adheres to best practices.

If you encounter any issues directly related to the Office JS APIs or platform functionality, feel free to reach out, and we’ll be happy to assist.

Best regards,

[davidchesnut]

Hi @malnoxon,

The brk-multihub is an exact match and does not support wildcards. So if you use brk-multihub://www.mydomain.com then https://company1.mydomain.com would not be allowed to acquire tokens.

Cheers,
David