Fixing issue #256 - Open Redirect vulnerability

italia / spid-cie-oidc-django

The SPID/CIE OIDC Federation SDK, written in Python

Apache License 2.0

27 stars 28 forks source link

Fixing issue #256 - Open Redirect vulnerability #257

Closed voidz0r closed 1 year ago

voidz0r commented 1 year ago

This fixes the above-mentioned vulnerability.

The "state" parameter should be intended as an anti XSRF mechanism and the application should check between the session-stored Anti XSRF token and the one provided in the state parameter passed during the authentication flow. This is not covered by this PR.

Note: this functionality is not tested and could break the existing test case so, please, change it accordingly.

peppelinux commented 1 year ago

Thank you for this important contribution