Skip to content
This repository has been archived by the owner on Jul 31, 2024. It is now read-only.

Strict redirect uri validator app auth with path #4245

Conversation

njparakh
Copy link
Contributor

@njparakh njparakh commented Apr 2, 2020

What issue does this PR address?
#3974

Does this PR introduce a breaking change?
No

Please check if the PR fulfills these requirements

  • [✓ ] The commit follows our guidelines
  • [ ✓] Unit Tests for the changes have been added (for bug fixes / features)

Other information:
This PR is similar to this one but does not use RegEx. It allows for a path in the Loopback address, but does not validate that path.

I'd like to acknowledge VictorioBerra - the unit tests added in this PR are based on the unit tests he wrote in his PR.

@dnfclas
Copy link

dnfclas commented Apr 2, 2020

CLA assistant check
All CLA requirements met.

@brockallen
Copy link
Member

Nice, thanks!

@brockallen brockallen merged commit 55dc4fb into IdentityServer:master May 7, 2020
@MichelJansson
Copy link

This is a great add.
But now with the SameSite cookie changes, everything needs to be HTTPS, even for loopback. Can we also allow https://127.0.0.1?

I realize it's only the http scheme that the RFC covers - but would it be less safe to also allow https?

@github-actions
Copy link

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Jul 29, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants