open redirect for target_link_uri parameter

[zandbelt]

see #671, thanks @Meheni

Recently we have forged a URL for a phishing attack that redirects the user, after their authentication on our OP, to any site of our choice.

the forged url is as follows:

https://<oidc_callback>?iss=<issuer>&target_link_uri=https://FQDN_phishing\.<domain_your_oidc_callback>/

example:

https://myapplication.local/app/redirect_oidc?iss=<issuer>&target_link_uri=https://google.fr\.myapplication.local

After authentication, user is redirect to https://google.fr\.myapplication.loca

According to the OpenID Connect documentation,
https://openid.net/specs/openid-connect-core-1_0.html#ThirdPartyInitiatedLogin

"target_link_uri
OPTIONAL. URL that the RP is requested to redirect to after authentication. RPs MUST verify the value of the target_link_uri to prevent being used as an open redirector to external sites."

Does the module verify the value of the target_link_uri to prevent being used as an open redirector to external sites? and how to configure it in the module?

[Meheni]

Hi,
Thank you for your work.

Meheni

[zandbelt]

this fix is now included in release 2.4.9.4

[Meheni]

Hi,

I just tested the new version 2.4.9.4 and the fixed works very well.

I have the following message on my browser :

Error:

URL not allowed

Description:

value does not match the list of allowed redirect URLs: https://google.fr/.myapplication.local

Thank you again for your work.

Best regards,
Meheni