CodeCow/stack
1
0
Fork 0
mirror of https://github.com/stack-auth/stack.git synced 2026-06-04 21:04:37 +08:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

fix: only trust https:// for built-with domain, not http://

Browse Source 
Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>
This commit is contained in:
Devin AI 2026-05-22 01:05:43 +00:00
parent d762041c9f
commit cfb9af807a
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
apps/backend/src/lib/redirect-urls.test.tsx
View File

@ -491,8 +491,8 @@ describe('validateRedirectUrl', () => {
expect(validateRedirectUrl(`https://${projectId}.built-with-stack-auth.com/`, tenancy)).toBe(true);
expect(validateRedirectUrl(`https://${projectId}.built-with-stack-auth.com/handler/oauth-callback`, tenancy)).toBe(true);
// HTTP on the built-with domain should also be trusted
expect(validateRedirectUrl(`http://${projectId}.built-with-stack-auth.com/callback`, tenancy)).toBe(true);
// HTTP on the built-with domain should NOT be trusted
expect(validateRedirectUrl(`http://${projectId}.built-with-stack-auth.com/callback`, tenancy)).toBe(false);
// Different project IDs should NOT be trusted
expect(validateRedirectUrl('https://other-project.built-with-stack-auth.com/callback', tenancy)).toBe(false);
@ -513,8 +513,9 @@ describe('validateRedirectUrl', () => {
},
}, projectId);
expect(validateRedirectUrl(`http://${projectId}.localhost:8109/callback`, tenancy)).toBe(true);
// Only HTTPS should be trusted, even for localhost-based dev suffix
expect(validateRedirectUrl(`https://${projectId}.localhost:8109/callback`, tenancy)).toBe(true);
expect(validateRedirectUrl(`http://${projectId}.localhost:8109/callback`, tenancy)).toBe(false);
// Wrong port should NOT be trusted
expect(validateRedirectUrl(`http://${projectId}.localhost:9999/callback`, tenancy)).toBe(false);

1
apps/backend/src/lib/redirect-urls.tsx
View File

@ -23,7 +23,6 @@ export function validateRedirectUrl(
allowLocalhost: tenancy.config.domains.allowLocalhost,
trustedDomains: [
...Object.values(tenancy.config.domains.trustedDomains).map(domain => domain.baseUrl),
`http://${hostedDomain}`,
`https://${hostedDomain}`,
],
});