Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Check if authorization_endpoint is valid in code flow #496

Merged
merged 1 commit into from
Sep 2, 2022
Merged

Check if authorization_endpoint is valid in code flow #496

merged 1 commit into from
Sep 2, 2022

Conversation

julien-nc
Copy link
Member

As we insert it in <meta> with Safari, it could lead to a XSS attack (but the CSRF prevents it).

Anyway good to validate this URL in any case.

check authorization_endpoint is valid before redirecting to it (or in…
89ef951 
…serting it in <meta> for safari)

Signed-off-by: Julien Veyssier <eneiluj@posteo.net>
@julien-nc julien-nc added enhancement New feature or request security Pull requests that address a security vulnerability labels Sep 2, 2022
@juliusknorr juliusknorr merged commit 4a61b57 into master Sep 2, 2022
@juliusknorr juliusknorr deleted the fix/noid/check-authorization_endpoint branch September 2, 2022 15:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@juliusknorr juliusknorr juliusknorr approved these changes

@nickvergessen nickvergessen Awaiting requested review from nickvergessen

Assignees
No one assigned
Labels
enhancement New feature or request security Pull requests that address a security vulnerability
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@julien-nc @juliusknorr