lexton-it/NextWks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(auth): state carries target URL, cross-subdomain cookie domain

Browse source
This commit is contained in:
Claus Lohmar 2026-06-15 20:18:26 +00:00
parent 94258749dc
commit b8db1f87f8
1 changed files with 10 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
src/core/auth/oidc.go
View file

@ -35,7 +35,14 @@ func NewOIDCHandler(config OIDCConfig, store *SessionStore) *OIDCHandler {
// LoginRedirect redirects the user to Authelia's OIDC authorization endpoint. // LoginRedirect redirects the user to Authelia's OIDC authorization endpoint.
func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) { func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) {
state := generateToken(16) // Get target URL from current request path
targetURL := r.URL.Path
if targetURL == "/" || targetURL == "/access" {
targetURL = "/"
}
// Embed target in state: random_token:target_url
randPart := generateToken(16)
state := randPart + ":" + targetURL
nonce := generateToken(16) nonce := generateToken(16)
// PKCE: generate code verifier and challenge // PKCE: generate code verifier and challenge
@ -45,7 +52,7 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) {
// Store state + verifier in cookies (shared across subdomains) // Store state + verifier in cookies (shared across subdomains)
http.SetCookie(w, &http.Cookie{ http.SetCookie(w, &http.Cookie{
Name: "oidc_state", Name: "oidc_state",
Value: state, Value: randPart,
Path: "/", Path: "/",
MaxAge: 300, MaxAge: 300,
HttpOnly: true, HttpOnly: true,
@ -65,7 +72,7 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) {
h.config.IssuerURL, h.config.IssuerURL,
url.QueryEscape(h.config.ClientID), url.QueryEscape(h.config.ClientID),
url.QueryEscape(h.config.RedirectURL), url.QueryEscape(h.config.RedirectURL),
state, url.QueryEscape(state),
nonce, nonce,
challenge, challenge,
) )
@ -243,7 +250,6 @@ func (h *OIDCHandler) LoginRedirectWithPrompt(w http.ResponseWriter, r *http.Req
verifier := generateToken(32) verifier := generateToken(32)
challenge := pkceChallenge(verifier) challenge := pkceChallenge(verifier)
authURL := fmt.Sprintf( authURL := fmt.Sprintf(
"%s/api/oidc/authorize?prompt=%s&response_type=code&client_id=%s&redirect_uri=%s&scope=openid+profile+email&state=%s&nonce=%s&code_challenge=%s&code_challenge_method=S256", "%s/api/oidc/authorize?prompt=%s&response_type=code&client_id=%s&redirect_uri=%s&scope=openid+profile+email&state=%s&nonce=%s&code_challenge=%s&code_challenge_method=S256",
h.config.IssuerURL, prompt, h.config.IssuerURL, prompt,