1d218cd6c9
The invalidRedirectRegex was checking the entire redirect string including query parameters, causing ADFS error callbacks to be rejected when error_description contains URLs (e.g., https://docs.microsoft.com/...). Fix: Only check the path portion against the regex. Additionally, check common redirect-related query parameters (url, next, redirect, etc.) for open redirect patterns, but allow other params like error_description to contain URLs. Fixes #3404 Signed-off-by: wucm667 <stevenwucongmin@gmail.com> |
||
|---|---|---|
| .. | ||
| apis | ||
| app | ||
| authentication | ||
| cookies | ||
| encryption | ||
| header | ||
| ip | ||
| logger | ||
| middleware | ||
| providers | ||
| proxyhttp | ||
| requests | ||
| sessions | ||
| upstream | ||
| util | ||
| validation | ||
| version | ||
| watcher | ||