@@ -98,7 +98,8 @@ func TestIsValidRedirect(t *testing.T) {
9898 opts.ClientID = "bazquux"
9999 opts.ClientSecret = "foobar"
100100 opts.CookieSecret = "xyzzyplugh"
101− opts.WhitelistDomains = []string{"foo.bar"}
101+ // Should match domains that are exactly foo.bar and any subdomain of bar.foo
102+ opts.WhitelistDomains = []string{"foo.bar", ".bar.foo"}
102103 opts.Validate()
103104
104105 proxy := NewOAuthProxy(opts, func(string) bool { return true })
@@ -112,12 +113,24 @@ func TestIsValidRedirect(t *testing.T) {
112113 doubleSlash := proxy.IsValidRedirect("//redirect")
113114 assert.Equal(t, false, doubleSlash)
114115
115− validHTTP := proxy.IsValidRedirect("http://baz.foo.bar/redirect")
116+ validHTTP := proxy.IsValidRedirect("http://foo.bar/redirect")
116117 assert.Equal(t, true, validHTTP)
117118
118− validHTTPS := proxy.IsValidRedirect("https://baz.foo.bar/redirect")
119+ validHTTPS := proxy.IsValidRedirect("https://foo.bar/redirect")
119120 assert.Equal(t, true, validHTTPS)
120121
122+ invalidHTTPSubdomain := proxy.IsValidRedirect("http://baz.foo.bar/redirect")
123+ assert.Equal(t, false, invalidHTTPSubdomain)
124+
125+ invalidHTTPSSubdomain := proxy.IsValidRedirect("https://baz.foo.bar/redirect")
126+ assert.Equal(t, false, invalidHTTPSSubdomain)
127+
128+ validHTTPSubdomain := proxy.IsValidRedirect("http://baz.bar.foo/redirect")
129+ assert.Equal(t, true, validHTTPSubdomain)
130+
131+ validHTTPSSubdomain := proxy.IsValidRedirect("https://baz.bar.foo/redirect")
132+ assert.Equal(t, true, validHTTPSSubdomain)
133+
121134 invalidHTTP1 := proxy.IsValidRedirect("http://foo.bar.evil.corp/redirect")
122135 assert.Equal(t, false, invalidHTTP1)
123136