authelia/shared/BelongToDomain.ts

import { DomainExtractor } from "./DomainExtractor";

export function BelongToDomain(url: string, domain: string): boolean {
  const urlDomain =  DomainExtractor.fromUrl(url);
  if (!urlDomain) return false;
  const idx = urlDomain.indexOf(domain);
  return idx + domain.length == urlDomain.length;
}
-												Fix open redirection vulnerability.

In order to redirect the user after authentication, Authelia uses
rd query parameter provided by the proxy. However an attacker could
use phishing to make the user be redirected to a bad domain. In order
to avoid the user to be redirected to a bad location, Authelia now
verifies the redirection URL is under the protected domain.

											
										
										
											2018-10-27 23:18:25 +07:00
+								import { DomainExtractor } from "./DomainExtractor";
 								export function BelongToDomain(url: string, domain: string): boolean {
 								  const urlDomain =  DomainExtractor.fromUrl(url);
 								  if (!urlDomain) return false;
 								  const idx = urlDomain.indexOf(domain);
 								  return idx + domain.length == urlDomain.length;
 								}