KEYCLOAK-2259
Redirect URIs and token domains are matched case-sensitively
This commit is contained in:
parent
a90d7e54d4
commit
ddd99c2411
2 changed files with 39 additions and 0 deletions
|
@ -63,6 +63,8 @@ public class RedirectUtils {
|
|||
logger.debug("No Redirect URIs supplied");
|
||||
redirectUri = null;
|
||||
} else {
|
||||
redirectUri = lowerCaseHostname(redirectUri);
|
||||
|
||||
String r = redirectUri.indexOf('?') != -1 ? redirectUri.substring(0, redirectUri.indexOf('?')) : redirectUri;
|
||||
Set<String> resolveValidRedirects = resolveValidRedirects(uriInfo, rootUrl, validRedirects);
|
||||
|
||||
|
@ -96,6 +98,15 @@ public class RedirectUtils {
|
|||
}
|
||||
}
|
||||
|
||||
private static String lowerCaseHostname(String redirectUri) {
|
||||
int n = redirectUri.indexOf('/', 7);
|
||||
if (n == -1) {
|
||||
return redirectUri.toLowerCase();
|
||||
} else {
|
||||
return redirectUri.substring(0, n).toLowerCase() + redirectUri.substring(n);
|
||||
}
|
||||
}
|
||||
|
||||
private static String relativeToAbsoluteURI(UriInfo uriInfo, String rootUrl, String relative) {
|
||||
if (rootUrl == null) {
|
||||
URI baseUri = uriInfo.getBaseUri();
|
||||
|
|
|
@ -65,8 +65,15 @@ public class OAuthRedirectUriTest {
|
|||
ClientModel installedApp3 = KeycloakModelUtils.createClient(appRealm, "test-wildcard");
|
||||
installedApp3.setEnabled(true);
|
||||
installedApp3.addRedirectUri("http://example.com/foo/*");
|
||||
installedApp3.addRedirectUri("http://with-dash.example.com/foo/*");
|
||||
installedApp3.addRedirectUri("http://localhost:8081/foo/*");
|
||||
installedApp3.setSecret("password");
|
||||
|
||||
ClientModel installedApp4 = KeycloakModelUtils.createClient(appRealm, "test-dash");
|
||||
installedApp4.setEnabled(true);
|
||||
installedApp4.addRedirectUri("http://with-dash.example.com");
|
||||
installedApp4.addRedirectUri("http://with-dash.example.com/foo");
|
||||
installedApp4.setSecret("password");
|
||||
}
|
||||
});
|
||||
|
||||
|
@ -216,6 +223,27 @@ public class OAuthRedirectUriTest {
|
|||
checkRedirectUri("http://localhost:8081/foobar", false, true);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testDash() throws IOException {
|
||||
oauth.clientId("test-dash");
|
||||
|
||||
checkRedirectUri("http://with-dash.example.com/foo", true);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testDifferentCaseInHostname() throws IOException {
|
||||
oauth.clientId("test-dash");
|
||||
|
||||
checkRedirectUri("http://with-dash.example.com", true);
|
||||
checkRedirectUri("http://wiTh-dAsh.example.com", true);
|
||||
checkRedirectUri("http://with-dash.example.com/foo", true);
|
||||
checkRedirectUri("http://wiTh-dAsh.example.com/foo", true);
|
||||
checkRedirectUri("http://with-dash.eXampLe.com/foo", true);
|
||||
checkRedirectUri("http://wiTh-dAsh.eXampLe.com/foo", true);
|
||||
checkRedirectUri("http://wiTh-dAsh.eXampLe.com/Foo", false);
|
||||
checkRedirectUri("http://wiTh-dAsh.eXampLe.com/foO", false);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testLocalhost() throws IOException {
|
||||
oauth.clientId("test-installed");
|
||||
|
|
Loading…
Reference in a new issue