Allow change of oauth2 redirect URL

[diaznet]

In my setup http://homeassistant.local:8123 is not reachable because I have implemented https on port 443 on a custom domain, please implement the possibility to use custom URLs

[majianming21]

you can replace the
http://homeassistant.local:8123/api
to you https url as https://exmple.com/api after oauth redirect. it is ok for me.
if provide it,may can go to attacker website

[diaznet]

Yes it works like that but you cannot expect that http://homeassistant.local:8123/api is and will be the standard for all users. Just thinking about https for example.
See my suggestion below.

[SusanPhevos]

As @majianming21 said, the oauth2 redirect URL is statically set by the server for security. It can not be changed.

[diaznet]

I think it should be a possibility to allow users to specify their own domain for Xiaomi Home (Home Assistant Integration) in https://account.xiaomi.com/

[mattholy]

我遇到了同样的问题。根据oauth2规范来看回调地址应该是可配置才对吧

[majianming21]

oauth中定义的回调地址只能是一个相对固定的值，无法用户期望什么就能定义成什么，这是一个安全问题，不是一个缺陷。
如果能被用户在url上修改，那么会攻击者可以修改该地址到他的服务上，造成用户的信息泄露

[acooler15]

希望可以自定义地址。攻击者如果可以修改该地址，是否意味着设备已经被控制？设备被攻击者控制的情况下，攻击者有不少方法可以拿到token吧

[harrywenjie]

相同的问题, 我的HA采用了https的配置, "http://homeassistant.local:8123/" 这个地址是访问不到的. 如果不能自定义这个Oauth2的URL, 那就根本登录不了.

[majianming21]

请查看 #6

[mik-laj]

I'm wondering if we can use my Home Assistant so that everyone can set up their own HA instance address, but still only have one domain on the whitelist.
https://my.home-assistant.io/redirect/oauth
This approach is used by Spotify integrations, for example. https://www.home-assistant.io/integrations/spotify/