From d01580e4e76b585b2f43a3004779c4f5d2529f17 Mon Sep 17 00:00:00 2001 From: Mike P Date: Sat, 1 Mar 2025 10:09:03 +0000 Subject: [PATCH] FEP-61cf: Avoid open redirection in the error case (#515) Co-authored-by: FenTiger Reviewed-on: https://codeberg.org/fediverse/fep/pulls/515 Co-authored-by: Mike P Co-committed-by: Mike P --- fep/61cf/fep-61cf.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fep/61cf/fep-61cf.md b/fep/61cf/fep-61cf.md index 11965d6..e3df212 100644 --- a/fep/61cf/fep-61cf.md +++ b/fep/61cf/fep-61cf.md @@ -82,7 +82,9 @@ The `/magic` endpoint at the user's home instance first checks that the user's b If so, it decodes the `bdest` destination URL. It performs a webfinger lookup on the root URL of the destination site and looks for a link with `rel` set to `http://purl.org/openwebauth/v1`. This identifies the target instance's "token endpoint". -The home instance constructs and issues a signed HTTPS request to this endpoint. The request also contains an additional signed header, `X-Open-Web-Auth`, containing a random string. Target instances do not use this header; it is provided to add additional entropy to the signature calculation. +If an error occurs during this step, the home instance should not redirect to the 'bdest' URL; this would allow it to be used as an open redirector. Instead it should respond with a suitable HTTP error code. + +On success, the home instance constructs and issues a signed HTTPS request to the discovered token endpoint. The request also contains an additional signed header, `X-Open-Web-Auth`, containing a random string. Target instances do not use this header; it is provided to add additional entropy to the signature calculation. ### 3. Target instance provides a token