This repository has been archived by the owner on Dec 13, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 4k
/
OidcReturnUrlParser.cs
70 lines (61 loc) · 2.35 KB
/
OidcReturnUrlParser.cs
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.
using System;
using System.Threading.Tasks;
using IdentityServer4.Models;
using IdentityServer4.Extensions;
using IdentityServer4.Validation;
using Microsoft.Extensions.Logging;
namespace IdentityServer4.Services
{
internal class OidcReturnUrlParser : IReturnUrlParser
{
private readonly IAuthorizeRequestValidator _validator;
private readonly IUserSession _userSession;
private readonly ILogger _logger;
public OidcReturnUrlParser(
IAuthorizeRequestValidator validator,
IUserSession userSession,
ILogger<OidcReturnUrlParser> logger)
{
_validator = validator;
_userSession = userSession;
_logger = logger;
}
public async Task<AuthorizationRequest> ParseAsync(string returnUrl)
{
if (IsValidReturnUrl(returnUrl))
{
var parameters = returnUrl.ReadQueryStringAsNameValueCollection();
var user = await _userSession.GetUserAsync();
var result = await _validator.ValidateAsync(parameters, user);
if (!result.IsError)
{
_logger.LogTrace("AuthorizationRequest being returned");
return new AuthorizationRequest(result.ValidatedRequest);
}
}
_logger.LogTrace("No AuthorizationRequest being returned");
return null;
}
public bool IsValidReturnUrl(string returnUrl)
{
if (returnUrl.IsLocalUrl())
{
var index = returnUrl.IndexOf('?');
if (index >= 0)
{
returnUrl = returnUrl.Substring(0, index);
}
if (returnUrl.EndsWith(Constants.ProtocolRoutePaths.Authorize, StringComparison.Ordinal) ||
returnUrl.EndsWith(Constants.ProtocolRoutePaths.AuthorizeCallback, StringComparison.Ordinal))
{
_logger.LogTrace("returnUrl is valid");
return true;
}
}
_logger.LogTrace("returnUrl is not valid");
return false;
}
}
}