@@ -68,6 +68,7 @@ type OAuthProxy struct {
6868 AuthOnlyPath string
6969
7070 redirectURL *url.URL // the url to receive requests at
71+ whitelistDomains []string
7172 provider providers.Provider
7273 ProxyPrefix string
7374 SignInMessage string
@@ -220,6 +221,7 @@ func NewOAuthProxy(opts *Options, validator func(string) bool) *OAuthProxy {
220221 provider: opts.provider,
221222 serveMux: serveMux,
222223 redirectURL: redirectURL,
224+ whitelistDomains: opts.WhitelistDomains,
223225 skipAuthRegex: opts.SkipAuthRegex,
224226 skipAuthPreflight: opts.SkipAuthPreflight,
225227 compiledRegex: opts.CompiledRegex,
@@ -563,7 +565,7 @@ func (p *OAuthProxy) GetRedirect(req *http.Request) (redirect string, err error)
563565 }
564566
565567 redirect = req.Form.Get("rd")
566− if redirect == "" || !strings.HasPrefix(redirect, "/") || strings.HasPrefix(redirect, "//") {
568+ if !p.IsValidRedirect(redirect) {
567569 redirect = req.URL.Path
568570 if strings.HasPrefix(redirect, p.ProxyPrefix) {
569571 redirect = "/"
@@ -573,6 +575,34 @@ func (p *OAuthProxy) GetRedirect(req *http.Request) (redirect string, err error)
573575 return
574576}
575577
578+// IsValidRedirect checks whether the redirect URL is whitelisted
579+func (p *OAuthProxy) IsValidRedirect(redirect string) bool {
580+ switch {
581+ case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//"):
582+ return true
583+ case strings.HasPrefix(redirect, "http://"):
584+ redirect = strings.TrimPrefix(redirect, "http://")
585+ redirect = strings.Split(redirect, "/")[0]
586+ for _, domain := range p.whitelistDomains {
587+ if strings.HasSuffix(redirect, domain) {
588+ return true
589+ }
590+ }
591+ return false
592+ case strings.HasPrefix(redirect, "https://"):
593+ redirect = strings.TrimPrefix(redirect, "https://")
594+ redirect = strings.Split(redirect, "/")[0]
595+ for _, domain := range p.whitelistDomains {
596+ if strings.HasSuffix(redirect, domain) {
597+ return true
598+ }
599+ }
600+ return false
601+ default:
602+ return false
603+ }
604+}
605+
576606// IsWhitelistedRequest is used to check if auth should be skipped for this request
577607func (p *OAuthProxy) IsWhitelistedRequest(req *http.Request) (ok bool) {
578608 isPreflightRequestAllowed := p.skipAuthPreflight && req.Method == "OPTIONS"
@@ -709,7 +739,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
709739 return
710740 }
711741
712− if !strings.HasPrefix(redirect, "/") || strings.HasPrefix(redirect, "//") {
742+ if !p.IsValidRedirect(redirect) {
713743 redirect = "/"
714744 }
715745