Merge pull request #4945 from Sachin-Mamoru/regex-vul

Added the recommended regex pattern to the docs
wso2 · Jan 7, 2025 · 87cfcf7 · 87cfcf7
2 parents b52e6e9 + f041da9
commit 87cfcf7
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 0 deletions.
diff --git a/en/identity-server/5.10.0/docs/administer/product-level-security-guidelines.md b/en/identity-server/5.10.0/docs/administer/product-level-security-guidelines.md
@@ -355,6 +355,9 @@ When configuring intermediate certificate validation for REST APIs, it is recomm
 
 For the scenarios listed below, you can define a regular expression to validate the callback URL. The default configuration allows any callback URL. Note that if you are using these scenarios, it is highly recommended to define the regular expression that validates and only allows access to specific callback URLs.
 
+!!! note
+    The recommended **callback URL regex** to use when testing the product is `^https:\/\/localhost:9443\/.*`. However, users should modify it to meet their requirements when they deploy the product. You can find the specific instructions through following sections.
+
 - [Password Recovery](../../learn/password-recovery)
 - [Username Recovery](../../learn/username-recovery)
 - [Self User Registration](../../learn/self-registration-and-account-confirmation/#configuring-self-registration)
diff --git a/en/identity-server/5.11.0/docs/administer/product-level-security-guidelines.md b/en/identity-server/5.11.0/docs/administer/product-level-security-guidelines.md
@@ -199,6 +199,9 @@ By default, XSS attacks are prevented in the latest WSO2 Identity Server version
 
 For the scenarios listed below, you can define a regular expression to validate the callback URL. The default configuration allows any callback URL. Note that if you are using these scenarios, it is highly recommended to define the regular expression that validates and only allows access to specific callback URLs.
 
+!!! note
+    The recommended **callback URL regex** to use when testing the product is `^https:\/\/localhost:9443\/.*`. However, users should modify it to meet their requirements when they deploy the product. You can find the specific instructions through following sections.
+
 - [Password Recovery](../../learn/password-recovery)
 - [Username Recovery](../../learn/username-recovery)
 - [Self User Registration](../../learn/self-registration-and-account-confirmation/#configuring-self-registration)

diff --git a/en/identity-server/6.0.0/docs/deploy/security/product-level-security-guidelines.md b/en/identity-server/6.0.0/docs/deploy/security/product-level-security-guidelines.md
@@ -360,6 +360,9 @@ Follow the steps below to change the default credentials.
 
 For the scenarios listed below, you can define a regular expression to validate the callback URL. The default configuration allows any callback URL. Note that if you are using these scenarios, it is highly recommended to define the regular expression that validates and only allows access to specific callback URLs.
 
+!!! note
+        The recommended **callback URL regex** to use when testing the product is `^https:\/\/localhost:9443\/.*`. However, users should modify it to meet their requirements when they deploy the product. You can find the specific instructions through following sections.
+
 - [Password Recovery](../../../guides/password-mgt/recover-password/#enable-password-recovery-via-email)
 - [Username Recovery](../../../guides/identity-lifecycles/recover-username/#enable-username-recovery)
 - [Self User Registration](../../../guides/identity-lifecycles/self-registration-workflow/)

diff --git a/en/identity-server/6.1.0/docs/deploy/security/product-level-security-guidelines.md b/en/identity-server/6.1.0/docs/deploy/security/product-level-security-guidelines.md
@@ -360,6 +360,9 @@ Follow the steps below to change the default credentials.
 
 For the scenarios listed below, you can define a regular expression to validate the callback URL. The default configuration allows any callback URL. Note that if you are using these scenarios, it is highly recommended to define the regular expression that validates and only allows access to specific callback URLs.
 
+!!! note
+        The recommended **callback URL regex** to use when testing the product is `^https:\/\/localhost:9443\/.*`. However, users should modify it to meet their requirements when they deploy the product. You can find the specific instructions through following sections.
+
 - [Password Recovery](../../../guides/password-mgt/recover-password/#enable-password-recovery-via-email)
 - [Username Recovery](../../../guides/identity-lifecycles/recover-username/#enable-username-recovery)
 - [Self User Registration](../../../guides/identity-lifecycles/self-registration-workflow/)