Prevent open redirect when checking SSO

Co-authored-by: Jasu Viding <jasu.viding@gmail.com>
keycloak · Mar 1, 2023 · 15ef5df · 15ef5df
1 parent e4bd6b7
commit 15ef5df
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/middleware/check-sso.js b/middleware/check-sso.js
@@ -61,7 +61,8 @@ module.exports = function (keycloak) {
       delete urlParts.query.auth_callback
       delete urlParts.query.state
 
-      const cleanUrl = URL.format(urlParts)
+      // Collapse leading slashes to a single slash to prevent open redirects
+      const cleanUrl = URL.format(urlParts).replace(/^\/+/, '/')
 
       //  Check SSO process is completed
       request.session.auth_is_check_sso_complete = true