Security Considerations of the Fabasoft Folio Client Web Browser Integration

The Fabasoft Folio Client runs as a local process on the workstation in the context of the user currently logged on and may share the user session with a web browser.

Once a user creates a session in the web browser client, the session cookie issued to the user is passed to the Fabasoft Folio Client. To securely pass this information, the Fabasoft Folio web browser extension (Microsoft Edge, Mozilla Firefox and Google Chrome) is used.

Note: This is only valid if a corresponding session cookie has been configured.

Microsoft Edge, Mozilla Firefox and Google Chrome

The web browser extension uses the WebExtension API and the native messaging protocol to communicate with the Fabasoft Folio Client. This communication can be restricted to scripts of a specified domain. This is enforced by the Fabasoft Folio Client by validating the source URL. The source URL cannot be manipulated by a script (security mechanism of the web browser extension technology). The native messaging host may only be used by the Fabasoft Folio web browser extension by default configuration.

Apple Safari

The Fabasoft Folio Browser App Extension uses the macOS Framework API to communicate with the Fabasoft Folio Client. In detail a ContentScript (on page), an extension handler (native extension background process) and local socket communication with the Fabasoft Folio UI process is used. This communication can be restricted to scripts of a specified domain. This is enforced by the Fabasoft Folio Client by validating the source URL. The source URL cannot be manipulated by a script (security mechanism of the Safari App Extension technology).

Fabasoft Folio Client

The Fabasoft Folio Client validates a cookie received from the web browser (expected format, size and parameters) and stores the current value in the cookie store. After the local checks, the cookie is sent to the server, where the authenticity and session information is validated. If the cookie is valid, the Fabasoft Folio Client stores the value in the in-memory cookie store of the HTTP client and uses it for further requests.

Communication Security

The communication with the Fabasoft Folio Client is only possible if the respective application was signed with a digital signature certificate and the issuer of this certificate is known to the Fabasoft Folio Client.

Configure the Allowed Domains

The usage of the Fabasoft Folio Client has to be allowed for specific domains by using the Fabasoft policy "VALIDDOMAINS" (see below). If such a policy does not exist or has an empty value, no domains are allowed by default.

If the policy has a non-empty value, this value has to conform to the syntax given below and will be applied exactly, without adding anything by default.

The registry key for Fabasoft Folio Client policies is as follows:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Fabasoft\NativeClient\Folio

In order to allow domains, this key has to contain the following named value:

"VALIDDOMAINS"="<valid-hosts>"

Syntax:

<valid-hosts>    = <host-pattern> { ( "," | ";" | " " ) <host-pattern> }.
<host-pattern>   = <host-name> [ ":" <port-number> ].
<host-name>      = <host-name-head> { "." <host-name-part> }.
<host-name-head> = <host-name-part> | { <name-char> } "*" { <name-char> }.
<host-name-part> = <name-char> { <name-char> }.
<port-number>    = <digit> { <digit> }.

The string value of VALIDDOMAINS has to consist of a list of host name patterns, separated by semicolons, commas or spaces. Each pattern consists of a host name and an optional port number. Each host name is composed of parts. The first part can contain at most one wild card character "*" according to RFC 6125, section 6.4.1: new window. This wild card character matches a (possibly empty) sequence of characters in exactly the first part of a host name (i.e., it never matches "."). Subsequent parts (other than the first one) must not contain the wild card character. If a host name pattern does not specify a port number, the pattern matches every port.