@@ -580,20 +580,13 @@ func (p *OAuthProxy) IsValidRedirect(redirect string) bool {
580580 switch {
581581 case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//"):
582582 return true
583− case strings.HasPrefix(redirect, "http://"):
584− redirect = strings.TrimPrefix(redirect, "http://")
585− redirect = strings.Split(redirect, "/")[0]
586− for _, domain := range p.whitelistDomains {
587− if strings.HasSuffix(redirect, domain) {
588− return true
589− }
583+ case strings.HasPrefix(redirect, "http://") || strings.HasPrefix(redirect, "https://"):
584+ redirectURL, err := url.Parse(redirect)
585+ if err != nil {
586+ return false
590587 }
591− return false
592− case strings.HasPrefix(redirect, "https://"):
593− redirect = strings.TrimPrefix(redirect, "https://")
594− redirect = strings.Split(redirect, "/")[0]
595588 for _, domain := range p.whitelistDomains {
596− if strings.HasSuffix(redirect, domain) {
589+ if (redirectURL.Host == domain) || (strings.HasPrefix(domain, ".") && strings.HasSuffix(redirectURL.Host, domain)) {
597590 return true
598591 }
599592 }