cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix redirect uri error

Browse source
This commit is contained in:
Livio Amstutz 2019-12-09 08:47:56 +01:00
parent 2b36498365
commit 7210be8e4b
2 changed files with 19 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

8
pkg/op/authrequest.go
View file

@ -105,14 +105,14 @@ func ValidateAuthReqScopes(scopes []string) error {
func ValidateAuthReqRedirectURI(uri, client_id string, responseType oidc.ResponseType, storage OPStorage) error { func ValidateAuthReqRedirectURI(uri, client_id string, responseType oidc.ResponseType, storage OPStorage) error {
if uri == "" { if uri == "" {
return ErrInvalidRequest("redirect_uri must not be empty") return ErrInvalidRequestRedirectURI("redirect_uri must not be empty")
} }
client, err := storage.GetClientByClientID(client_id) client, err := storage.GetClientByClientID(client_id)
if err != nil { if err != nil {
return ErrServerError(err.Error()) return ErrServerError(err.Error())
} }
if !utils.Contains(client.RedirectURIs(), uri) { if !utils.Contains(client.RedirectURIs(), uri) {
return ErrInvalidRequest("redirect_uri not allowed") return ErrInvalidRequestRedirectURI("redirect_uri not allowed")
} }
if strings.HasPrefix(uri, "https://") { if strings.HasPrefix(uri, "https://") {
return nil return nil
@ -127,10 +127,10 @@ func ValidateAuthReqRedirectURI(uri, client_id string, responseType oidc.Respons
return ErrInvalidRequest("redirect_uri not allowed 2") return ErrInvalidRequest("redirect_uri not allowed 2")
} else { } else {
if client.ApplicationType() != ApplicationTypeNative { if client.ApplicationType() != ApplicationTypeNative {
return ErrInvalidRequest("redirect_uri not allowed 3") return ErrInvalidRequestRedirectURI("redirect_uri not allowed 3")
} }
if !(strings.HasPrefix(uri, "http://localhost:") || strings.HasPrefix(uri, "http://localhost/")) { if !(strings.HasPrefix(uri, "http://localhost:") || strings.HasPrefix(uri, "http://localhost/")) {
return ErrInvalidRequest("redirect_uri not allowed 4") return ErrInvalidRequestRedirectURI("redirect_uri not allowed 4")
} }
} }
return nil return nil

22
pkg/op/error.go
View file

@ -22,6 +22,13 @@ var (
Description: description, Description: description,
} }
} }
ErrInvalidRequestRedirectURI = func(description string) *OAuthError {
return &OAuthError{
ErrorType: InvalidRequest,
Description: description,
redirectDisabled: true,
}
}
ErrServerError = func(description string) *OAuthError { ErrServerError = func(description string) *OAuthError {
return &OAuthError{ return &OAuthError{
ErrorType: ServerError, ErrorType: ServerError,
@ -43,10 +50,6 @@ func AuthRequestError(w http.ResponseWriter, r *http.Request, authReq ErrAuthReq
http.Error(w, err.Error(), http.StatusBadRequest) http.Error(w, err.Error(), http.StatusBadRequest)
return return
} }
if authReq.GetRedirectURI() == "" {
http.Error(w, err.Error(), http.StatusBadRequest)
return
}
e, ok := err.(*OAuthError) e, ok := err.(*OAuthError)
if !ok { if !ok {
e = new(OAuthError) e = new(OAuthError)
@ -54,6 +57,10 @@ func AuthRequestError(w http.ResponseWriter, r *http.Request, authReq ErrAuthReq
e.Description = err.Error() e.Description = err.Error()
} }
e.state = authReq.GetState() e.state = authReq.GetState()
if authReq.GetRedirectURI() == "" || e.redirectDisabled {
http.Error(w, e.Description, http.StatusBadRequest)
return
}
params, err := utils.URLEncodeResponse(e, encoder) params, err := utils.URLEncodeResponse(e, encoder)
if err != nil { if err != nil {
http.Error(w, err.Error(), http.StatusBadRequest) http.Error(w, err.Error(), http.StatusBadRequest)
@ -81,9 +88,10 @@ func ExchangeRequestError(w http.ResponseWriter, r *http.Request, err error) {
} }
type OAuthError struct { type OAuthError struct {
ErrorType errorType `json:"error" schema:"error"` ErrorType errorType `json:"error" schema:"error"`
Description string `json:"description" schema:"description"` Description string `json:"description" schema:"description"`
state string `json:"state" schema:"state"` state string `json:"state" schema:"state"`
redirectDisabled bool
} }
func (e *OAuthError) Error() string { func (e *OAuthError) Error() string {