From 7f990987de0f760313a746df8b1b5057a562d2a0 Mon Sep 17 00:00:00 2001 From: kitos Date: Wed, 24 Jun 2026 14:32:32 +0200 Subject: [PATCH] fix(sso): block protocol-relative URL redirect bypass by requiring non-empty netloc --- backend/app/routers/sso.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/backend/app/routers/sso.py b/backend/app/routers/sso.py index db0ca91..8f39aa5 100644 --- a/backend/app/routers/sso.py +++ b/backend/app/routers/sso.py @@ -76,7 +76,8 @@ def sso_login(request: Request, db: Session = Depends(get_db)): except RuntimeError as exc: raise HTTPException(status_code=503, detail=str(exc)) redirect_url = result["redirect_url"] - if urlparse(redirect_url).scheme not in ("http", "https"): + _parsed = urlparse(redirect_url.strip()) + if _parsed.scheme not in ("http", "https") or not _parsed.netloc: raise HTTPException(status_code=400, detail="Invalid IdP redirect URL") return RedirectResponse(url=redirect_url)