pepepper/fluxer
1
0 Fork 0
mirror of https://github.com/fluxerapp/fluxer synced 2026-10-17 13:05:32 +09:00
Code Issues Packages Projects Releases Wiki Activity

fix: SSO Issuer URL formatted incorrectly (#1096)

Browse Source 
Co-authored-by: Jiralite <[email protected]>
This commit is contained in:
Jason ZherdevandJiralite authored and GitHub committed 2026-07-01 17:40:00 +01:00
1 parent 34ef4df925
commit 4a518b8e68
2 files changed
+9 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

fluxer_api/src/api/auth/services/SsoService.ts
+3 -4
View File
@@ -644,7 +644,7 @@ export class SsoService {
}
private async getOrCreateJwks(jwksUrl: string): Promise<RemoteJwkSetResolver> {
await this.validatePublicOutboundUrl(jwksUrl, 'jwks_url');
await this.assertPublicOutboundUrl(jwksUrl, 'jwks_url');
const now = Date.now();
const cached = this.jwksCache.get(jwksUrl);
if (cached && now - cached.cachedAt < SsoService.JWKS_CACHE_TTL_MS) {
@@ -893,7 +893,7 @@ export class SsoService {
};
}
private async validatePublicOutboundUrl(rawUrl: string, fieldName: string): Promise<URL> {
private async assertPublicOutboundUrl(rawUrl: string, fieldName: string): Promise<string> {
return validateSsoPublicOutboundUrl(rawUrl, fieldName);
}
@@ -902,8 +902,7 @@ export class SsoService {
return null;
}
try {
const validUrl = await this.validatePublicOutboundUrl(rawUrl, fieldName);
return validUrl.toString();
return await this.assertPublicOutboundUrl(rawUrl, fieldName);
} catch (error) {
this.logger.warn({fieldName, rawUrl, error}, 'Ignoring SSO URL that failed outbound policy validation');
return null;
fluxer_api/src/api/instance/SsoConfigValidation.ts
+6 -4
View File
@@ -86,7 +86,7 @@ export function normalizeSsoAllowedEmailDomains(domains: Array<string>): Array<s
return Array.from(normalized);
}
export async function validateSsoPublicOutboundUrl(rawUrl: string, fieldName: string): Promise<URL> {
export async function validateSsoPublicOutboundUrl(rawUrl: string, fieldName: string): Promise<string> {
let parsedUrl: URL;
try {
parsedUrl = new URL(rawUrl);
@@ -104,7 +104,10 @@ export async function validateSsoPublicOutboundUrl(rawUrl: string, fieldName: st
} catch {
throw InputValidationError.fromCode(fieldName, ValidationErrorCodes.INVALID_URL_FORMAT);
}
return parsedUrl;
// Return the caller's exact input rather than parsedUrl.toString(), which would normalize
// the URL (e.g. appending a trailing slash) and break exact-match comparisons such as the
// OIDC issuer check in jwtVerify. Invalid URLs have already thrown above.
return rawUrl;
}
async function normalizeOptionalSsoUrl(
@@ -116,8 +119,7 @@ async function normalizeOptionalSsoUrl(
if (!normalized || skipValidation) {
return normalized;
}
const validUrl = await validateSsoPublicOutboundUrl(normalized, fieldName);
return validUrl.toString();
return validateSsoPublicOutboundUrl(normalized, fieldName);
}
function resolveSsoReadiness(config: SsoConfigValidationInput, isTestProvider: boolean): boolean {