Class ReturnUrlPath

Namespace

Fdyay.IdentityServer.Hosting

Assembly

Fdyay.IdentityServer.AspNetCore.dll

Whether a return URL is a path on this server naming a particular endpoint.

public static class ReturnUrlPath

Inheritance

object

ReturnUrlPath

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

The guard between resuming a protocol request and sending a freshly authenticated user wherever a link said, so it is one implementation rather than one per protocol: two copies of a check like this drift, and the copy that drifts is a redirector.

Everything it accepts is a path on this server naming exactly the endpoint asked about. The comparison is against the whole path rather than a prefix, which is what refuses the shapes that look relative and are not — //evil.example.com/connect/authorize is read by a browser as an absolute URL on the current scheme, /\evil.example.com/… is the same trick against a check that only looked for a double slash, and /connect/authorize/../../evil never looks like the endpoint however a browser resolves it later.

Methods

Matches(string?, string, HttpContext?)

public static bool Matches(string? returnUrl, string endpointPath, HttpContext? context)

Parameters

returnUrl string

The return URL as it was handed to the interactive page.

endpointPath string

The endpoint's application-relative path, e.g. /connect/authorize.

context HttpContext

The request in flight, for its path base. The return URL is built by CurrentRequest(HttpContext) and carries the path base, so comparing against the bare protocol path would reject every request on a host mounted under UsePathBase — the interactive page refusing to resume a request this server itself issued. Null off a request, where the unmounted shape is the only one that can be checked: refusing everything instead would be a hard failure in a host that calls this from a background context.

Returns

bool

WithoutOrigin(string?, HttpContext?)

An absolute return URL on this server's origin, with the origin taken off; any other URL unchanged. Duende's AllowOriginInReturnUrl.

public static string? WithoutOrigin(string? returnUrl, HttpContext? context)

Parameters

returnUrl string

context HttpContext

Returns

string

Remarks

Duende 8.0.1's return-URL parsers, measured: an absolute URL whose text starts with the origin, compared ignoring case, loses it, and what is left is judged by Matches(string?, string, HttpContext?) as any relative return URL is. A lookalike — https://sts.example.com.evil.example/…, https://sts.example.com@evil.example/… — leaves something that is not a path, and is refused there. Off a request there is no origin, and nothing is taken off.