mirrors/fep
1
0
Fork 0
mirror of https://codeberg.org/fediverse/fep.git synced 2026-08-05 11:46:04 +00:00
Code Packages Wiki Activity

FEP-61cf: Avoid open redirection in the error case (#515)

Browse Source 
Co-authored-by: FenTiger <fentiger@mythik.co.uk>
Reviewed-on: https://codeberg.org/fediverse/fep/pulls/515
Co-authored-by: Mike P <fentiger@noreply.codeberg.org>
Co-committed-by: Mike P <fentiger@noreply.codeberg.org>
This commit is contained in:
Mike P
2025-03-01 10:09:03 +00:00
committed by silverpill
parent 653698e2bf
commit d01580e4e7
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fep/61cf/fep-61cf.md
+3 -1
View File
@@ -82,7 +82,9 @@ The `/magic` endpoint at the user's home instance first checks that the user's b
If so, it decodes the `bdest` destination URL. It performs a webfinger lookup on the root URL of the destination site and looks for a link with `rel` set to `http://purl.org/openwebauth/v1`. This identifies the target instance's "token endpoint".
The home instance constructs and issues a signed HTTPS request to this endpoint. The request also contains an additional signed header, `X-Open-Web-Auth`, containing a random string. Target instances do not use this header; it is provided to add additional entropy to the signature calculation.
If an error occurs during this step, the home instance should not redirect to the 'bdest' URL; this would allow it to be used as an open redirector. Instead it should respond with a suitable HTTP error code.
On success, the home instance constructs and issues a signed HTTPS request to the discovered token endpoint. The request also contains an additional signed header, `X-Open-Web-Auth`, containing a random string. Target instances do not use this header; it is provided to add additional entropy to the signature calculation.
### 3. Target instance provides a token