@@ -437,21 +437,23 @@ func (p *OAuthProxy) IsValidRedirect(redirect string) bool {
437437 }
438438 redirectHostname := redirectURL.Hostname()
439439
440− for _, domain := range p.whitelistDomains {
441− domainHostname, domainPort := splitHostPort(strings.TrimLeft(domain, "."))
442− if domainHostname == "" {
440+ for _, allowedDomain := range p.whitelistDomains {
441+ allowedHost, allowedPort := splitHostPort(allowedDomain)
442+ if allowedHost == "" {
443443 continue
444444 }
445445
446− if (redirectHostname == domainHostname) || (strings.HasPrefix(domain, ".") && strings.HasSuffix(redirectHostname, domainHostname)) {
446+ if redirectHostname == strings.TrimPrefix(allowedHost, ".") ||
447+ (strings.HasPrefix(allowedHost, ".") &&
448+ strings.HasSuffix(redirectHostname, allowedHost)) {
447449 // the domain names match, now validate the ports
448450 // if the whitelisted domain's port is '*', allow all ports
449451 // if the whitelisted domain contains a specific port, only allow that port
450452 // if the whitelisted domain doesn't contain a port at all, only allow empty redirect ports ie http and https
451453 redirectPort := redirectURL.Port()
452− if (domainPort == "*") ||
453− (domainPort == redirectPort) ||
454− (domainPort == "" && redirectPort == "") {
454+ if allowedPort == "*" ||
455+ allowedPort == redirectPort ||
456+ (allowedPort == "" && redirectPort == "") {
455457 return true
456458 }
457459 }