@@ -576,6 +576,7 @@ func (p *OAuthProxy) IsValidRedirect(redirect string) bool {
576576 case strings.HasPrefix(redirect, "http://") || strings.HasPrefix(redirect, "https://"):
577577 redirectURL, err := url.Parse(redirect)
578578 if err != nil {
579+ logger.Printf("Rejecting invalid redirect %q: scheme unsupported or missing", redirect)
579580 return false
580581 }
581582 redirectHostname := redirectURL.Hostname()
@@ -600,8 +601,10 @@ func (p *OAuthProxy) IsValidRedirect(redirect string) bool {
600601 }
601602 }
602603
604+ logger.Printf("Rejecting invalid redirect %q: domain / port not in whitelist", redirect)
603605 return false
604606 default:
607+ logger.Printf("Rejecting invalid redirect %q: not an absolute or relative URL", redirect)
605608 return false
606609 }
607610}