- This prevents a malicious user from crafting a redirect  URL to a nefarious site under their control.

Introduce a utility function `uriFromURL` to strip host information fromredirect URLs, ensuring redirects remain local. This mitigates potentialsecurity risks by preventing redirects to external malicious sites.Changes:- Modify OAuth2 and OIDC callback logic to utilize `uriFromURL`.- Enhance related test cases for preventing external redirects.This work ensures secure handling of redirect URLs across the application.

- Removed an unnecessary blank line for code consistency.

- Improve handling of redirect logic in FakeIDP.- Ensure existing CheckRedirect functions are respected.- Enhance OIDC login test to handle redirects properly.

- Improve handling of redirect logic in FakeIDP by ensuring existing CheckRedirect functions are respected.- Enhance related test cases for better testing of redirect behaviors.Changes:- Store claims if state is available before falling back to existing CheckRedirect.- Ensure HTTP client transport is set to default in tests before assigning CheckRedirect.

Removing a leftover debug print statement to clean up the code.

- Prevent redirecting the last step in the OIDC flow involving the state  parameter, ensuring it remains part of the core OIDC process.- This ensures secure and consistent handling of redirects in the OIDC  login flow.

Update the OAuth redirect URL test to exclude fragmentPreviously, the test included a fragment in the constructed URL.Removing the fragment ensures consistency with the actual URL formatused in the application.

Emyrk left a comment