Verify the connection ID to avoid malicious attempts to store credentials for another user

The problem

Issue NangoHQ/nango#582 (closed, 6 comments): Raised by this community message (and a couple other ones before). We should have a mechanism to verify the connection ID to avoid malicious attempts to store credentials for another user in the application.

What fixed it

[bastienbeurier (member)]: To stop attackers spoofing user accounts during OAuth, Nango added HMAC verification. Set NANGOHMACREQUIRED=true, NANGOHMACALGORITHM=sha256, and NANGOHMACKEY to a secret server-side, then pass the digest in nango.auth with an hmac option. Resolved by PR #591.

In gh:NangoHQ/nango#582 (Nango), the issue reported was: Issue NangoHQ/nango#582 (closed, 6 comments): Raised by this community message (and a couple other ones before). We should have a mechanism to verify the connection ID to avoid malicious attempts to store credentials for another user in the application. The verified resolution from the thread: [bastienbeurier (member)]: To stop attackers spoofing user accounts during OAuth, Nango added HMAC verification. Set NANGOHMACREQUIRED=true, NANGOHMACALGORITHM=sha256, and NANGOHMACKEY to a secret server-side, then pass the digest in nango.auth with an hmac option. Resolved by PR #591. Source: mount the host path https at container path //github.com/NangoHQ/nango/issues/582