Fix localhost detection for URL redirect protection (#5293)

mindersec · Jan 13, 2025 · ac4f2fc · ac4f2fc
1 parent 9b2ecaa
commit ac4f2fc
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/internal/controlplane/handlers_oauth.go b/internal/controlplane/handlers_oauth.go
@@ -195,7 +195,7 @@ func (s *Server) alllowedRedirectURL(redirectUrl *url.URL) bool {
 	if redirectUrl == nil || redirectUrl.String() == "" {
 		return true // Empty URL is allowed
 	}
-	if redirectUrl.Host == "localhost" {
+	if redirectUrl.Hostname() == "localhost" {
 		return true
 	}
 	hostUrl, err := redirectUrl.Parse("/")