Bug #19240
closed
Avoid open redirect in login process
Added by Peter Amstutz over 2 years ago.
Updated about 2 years ago.
Estimated time:
(Total: 0.00 h)
Release relationship:
Auto
Description
Add config option to allow redirect-with-token to http[s]://ipaddr:port/ where ipaddr is in one of the reserved private IP ranges ("not recommended for production")
- Target version changed from 2022-07-20 to 2022-08-03 Sprint
- Target version changed from 2022-08-03 Sprint to 2022-08-17 sprint
- Target version changed from 2022-08-17 sprint to 2022-08-31 sprint
- Target version changed from 2022-08-31 sprint to 2022-09-28 sprint
- Target version changed from 2022-09-28 sprint to 2022-10-12 sprint
- Target version changed from 2022-10-12 sprint to 2022-10-26 sprint
- Target version changed from 2022-10-26 sprint to 2022-11-09 sprint
- Description updated (diff)
- Assigned To set to Tom Clegg
- Status changed from New to In Progress
The code LGTM. There's just one suggestion:
- In
LoginCluster
federations, the admin need to list the satellite cluster's URLs, so I think we would need one of two things:
- The easiest: Add a note about that on the upgrade notes.
- The fancier: Make
controller
discover the URLs, as it doesn't make sense to avoid logins on a LoginCluster.
The "fancier" may have some edge cases, like periodically polling for URL changes, and error handling, so the "easiest" alternative is fine with me, it would just add some burden to the admins
Addendum: I did read the added upgrade notes, but I think it would be nice to explicitly say that LoginCluster federations also need this config update.
Good point. Added a bit to call out the federation case specifically.
Agree automatically recognizing remote clusters' URLs would be better, but I think we can call that an additional feature...? (We're already relying on adding these manually. I updated the relevant bits of the federation docs to a) remind to add wb2 as well as wb1 and b) use proper example domains like cluster2.example instead of cluster2.com)
19240-check-redirect @ 710dc7f830f65232389cf191028edfdfe4cefe77
- Status changed from In Progress to Resolved
Also available in: Atom
PDF