oppi.li / perf-test
loading up the forgejo repo on tangled to test page performance
0
fork

Configure Feed

Select the types of activity you want to include in your feed.

Add comment for ContainsRedirectURI about the exact match (#30457)

Close #26897
Replace #30336

(cherry picked from commit 92e27e15c38b95be2309dae316b896ee1d80324b)

authored by

wxiaoguang and committed by
Gergely Nagy 27977851 86736193

+5
+5
models/auth/oauth2.go
··· 144 144 145 145 // ContainsRedirectURI checks if redirectURI is allowed for app 146 146 func (app *OAuth2Application) ContainsRedirectURI(redirectURI string) bool { 147 + // OAuth2 requires the redirect URI to be an exact match, no dynamic parts are allowed. 148 + // https://stackoverflow.com/questions/55524480/should-dynamic-query-parameters-be-present-in-the-redirection-uri-for-an-oauth2 149 + // https://www.rfc-editor.org/rfc/rfc6819#section-5.2.3.3 150 + // https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest 151 + // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics-12#section-3.1 147 152 contains := func(s string) bool { 148 153 s = strings.TrimSuffix(strings.ToLower(s), "/") 149 154 for _, u := range app.RedirectURIs {