search

thephpleague / oauth2-server

A spec compliant, secure by default PHP OAuth 2.0 Server
https://oauth2.thephpleague.com
MIT License
6.52k stars 1.12k forks source link

Redirection URI validation and rfc8252 #1188

Closed exeba closed 2 years ago

exeba commented 3 years ago

As far as I understand the current implementation requires a perfect match between the registered redirection URI and the URI specified in the authorization request.

However, section 8.4 of rfc8252 states:

Authorization servers MUST require clients to register their complete redirect URI (including the path component) and reject authorization requests that specify a redirect URI that doesn't exactly match the one that was registered; the exception is loopback redirects, where an exact match is required except for the port URI component.

Nikita128 commented 3 years ago

Yeah, we've encountered the same exact issue recently. I've created a separate post about this.

Sephster commented 3 years ago

Thanks both. Happy to accept a PR but this looks like something we should resolve. I will flag it for a future update.

xbojer commented 3 years ago

This change causes Undefined index: scheme error for invalid uri in isLoopbackUri method of RedirectUriValidator. Maybe there should be check if provided string is uri before parsing it

eugene-borovov commented 3 years ago

PR #1237 fixes this issue.