Merge pull request #194 from r4um/validate-state
Validate state param while redirecting.
commitd5a332c3f2de57b28e35270ae7d114cea8e9b64a
authorJehiah Czebotar <jehiah@gmail.com>
dateTue 19 Jan 2016, 10:21 (11 years ago)
parent613a342f957a1e
oauthproxy.go+1−1
@@ -476,7 +476,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
476476 }
477477
478478 redirect := req.Form.Get("state")
479− if redirect == "" {
479+ if !strings.HasPrefix(redirect, "/") {
480480 redirect = "/"
481481 }
482482