jubnl 0ee53e7b38 fix: prevent OIDC redirect URI construction from untrusted X-Forwarded-Host ...

The OIDC login route silently fell back to building the redirect URI from
X-Forwarded-Host/X-Forwarded-Proto when APP_URL was not configured. An
attacker could set X-Forwarded-Host: attacker.example.com to redirect the
authorization code to their own server after the user authenticates.

Remove the header-derived fallback entirely. If APP_URL is not set (via env
or the app_url DB setting), the OIDC login endpoint now returns a 500 error
rather than trusting attacker-controlled request headers. Document APP_URL
in .env.example as required for OIDC use.

2026-04-01 07:56:55 +02:00

..

public

Merge branch 'perf-test' of https://github.com/jubnl/TREK into dev

2026-03-31 23:10:02 +02:00

src

fix: prevent OIDC redirect URI construction from untrusted X-Forwarded-Host

2026-04-01 07:56:55 +02:00

.env.example

fix: prevent OIDC redirect URI construction from untrusted X-Forwarded-Host

2026-04-01 07:56:55 +02:00

package-lock.json

Merge branch 'pr-125'

2026-03-30 23:10:34 +02:00

package.json

Merge branch 'pr-125'

2026-03-30 23:10:34 +02:00

reset-admin.js

Stabilize core: better-sqlite3, versioned migrations, graceful shutdown

2026-03-22 17:52:24 +01:00

tsconfig.json

some fixes

2026-03-30 06:59:24 +02:00