go-pkgz / auth / 24596751515

85%

master: 85%

Pull #275

github

fix(provider): port-insensitive host check + log only host on rejection

Address Copilot review on PR #275:

* isAllowedRedirect compared u.Host (which includes port). A from URL
  like https://app.example.com:443/x against an Opts.URL of
  https://app.example.com would be rejected even though they are the
  same origin. Switch to u.Hostname() so the explicit-default-port form
  matches, and add three test cases (https:443, http:80, non-default :8080).

* The rejection log lines wrote the full from URL, leaking
  attacker-supplied paths/query strings into operator logs. Add
  redirectHostForLog helper (parses and returns just the hostname,
  sentinel on parse failure) and use it from all four sites
  (oauth1/oauth2/apple/verify). Covered by TestRedirectHostForLog.

106 of 109 new or added lines in 7 files covered. (97.25%)

2789 of 3296 relevant lines covered (84.62%)

7.68 hits per line