Skip to content

fix: treat single-label-domains as valid#217

Closed
alexdao3 wants to merge 1 commit intoSAML-Toolkits:masterfrom
urbint:master
Closed

fix: treat single-label-domains as valid#217
alexdao3 wants to merge 1 commit intoSAML-Toolkits:masterfrom
urbint:master

Conversation

@alexdao3
Copy link
Copy Markdown

@alexdao3 alexdao3 commented Oct 20, 2020

Fixes #108

In Docker/Kubernetes/testing, it's common to have a service/hostname
without a domain i.e. http://saml-service:5555. Some places refer to
these as single-label-domains[1]

Previously validate_url only allowed localhost and considered other
hostnames invalid if they didn't contain a domain suffix. This relaxes
the restriction to allow for single-label-domains

[1] https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/single-label-domains-support-policy

In Docker/Kubernetes/testing, it's common to have a service/hostname
without a domain i.e. http://saml-service:5555. Some places refer to
these as single-label-domains[1]

Previously validate_url only allowed `localhost` and considered other
hostnames invalid if they didn't contain a domain suffix. This relaxes
the restriction to allow for single-label-domains

[1] https://docs.microsoft.com/en-us/troubleshoot/windows-server/
networking/single-label-domains-support-policy
@pitbulk
Copy link
Copy Markdown
Contributor

pitbulk commented Nov 24, 2020

Sorry for the delay,

I'm not able to find any reference on the SAML standard about single-label-domains.
Not sure about the security implications of allowing them.

That is a common request from the Docker/Kubernetes world, I'm open to allow them, but by a new setting.

@alexdao3 are you able to modify your PR to include a new advanced setting:

allowSingleLabelDomains

by default set to False

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

URL validator should allow single label hostnames (those without a dot)

2 participants