fix(controlplane): validate the OIDC login callback URL (CP-N2)
Merged
MI
3mo ago+147+147+012345678901234567890123456789-9-9-0123456789
The callback query parameter of /auth/login was stored in a cookie and later redirected to verbatim, with no validation of scheme or host. A crafted login link ended the OIDC flow at an arbitrary origin with the user JWT in the query string.
The callback is now restricted to:
- relative paths, used by the CAS download redirect
- loopback on any port (
localhost,127.0.0.0/8,::1), used by the CLI login - the origins the deployment already declares: the control plane external URL, the login URL and
ui_dashboard_url
Validation runs before the OIDC flow starts and is repeated on the callback leg so a tampered cookie cannot reopen the redirect. The token redirect also sets Cache-Control: no-store and Referrer-Policy: no-referrer.
No new configuration is introduced: existing deployments keep working through ui_dashboard_url and server.http.external_url, and rejections name the offending origin.
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri