Add a allowOrigin option to bypass invalid origins

[luis-almeida]

✌️

/cc @zendesk/vegemite

Description

In Guide (Help Center) we have successfully built a POC for an enduser app using zaf, zaf_sdk and zcli. We are now doing a final push to release this app in an EAP.

As we talked about in one of our last meetings, Help Center supports host-mapped domains and this is currently leading to Invalid domain [origin] error screens. In this PR we're following your recommendation to introduce a way to bypass this check.

We understand this allow list was added in #58 to address a security vulnerability so I'm thinking that, even thought left undocumented, this solution might reopen that vulnerability.

We'd really appreciate your feedback here 🙏🏼
Alternatively, help us think of another way to have this available only in Help Center.

Tasks

• Include comments/inline docs where appropriate
• Add unit tests
• Update changelog here

References

• JIRA: https://zendesk.atlassian.net/browse/VEG-XXX

DevQA Steps

• Make sure Zendesk Apps Framework regression tests are passing with this change.
• Add specific DevQA instructions here ....

NOTE: DevQA steps are to be actioned only once code has been reviewed and approved.

Risks

• [HIGH | medium | low] Does it work across browsers (including IE!)?
• [HIGH | medium | low] Does it work in the different products (Support, Chat, Connect)?
• [HIGH | medium | low] Are there any performance implications?
• [HIGH | medium | low] Any security risks?
• [HIGH | medium | low] What features does this touch?

Rollback Plan

1. Quickly roll back to the prior release so that customers can refresh to resolve their issue.
2. Revert this PR to restore the master branch to a deployable green state.
3. Notify the author.

[token-cjg]

I suspect that we'll want to adopt a different approach, as this will create a security issue if we follow it as-is.

[GorkaCardona]

Thanks @token-cjg for the fast response! @taoza @dahall-Z3N

What would be your teams recommendation for a different approach?

[GorkaCardona]

I should have tagged @zach-anthony above instead of David and Tao, sorry for the confusion.