@@ -364,8 +364,16 @@ async fn handle_request(oidc_state: &OidcState, request: ServiceRequest) -> Midd
364364 log:: trace!( "Started OIDC middleware request handling" ) ;
365365 oidc_state. refresh_if_expired ( & request) . await ;
366366
367- let redirect_uri = format ! ( "{}{}" , oidc_state. config. site_prefix. trim_end_matches( '/' ) , SQLPAGE_REDIRECT_URI ) ;
368- let logout_uri = format ! ( "{}{}" , oidc_state. config. site_prefix. trim_end_matches( '/' ) , SQLPAGE_LOGOUT_URI ) ;
367+ let redirect_uri = format ! (
368+ "{}{}" ,
369+ oidc_state. config. site_prefix. trim_end_matches( '/' ) ,
370+ SQLPAGE_REDIRECT_URI
371+ ) ;
372+ let logout_uri = format ! (
373+ "{}{}" ,
374+ oidc_state. config. site_prefix. trim_end_matches( '/' ) ,
375+ SQLPAGE_LOGOUT_URI
376+ ) ;
369377
370378 if request. path ( ) == redirect_uri {
371379 let response = handle_oidc_callback ( oidc_state, request) . await ;
@@ -645,7 +653,8 @@ async fn process_oidc_callback(
645653 nonce,
646654 redirect_target,
647655 } = parse_login_flow_state ( & tmp_login_flow_state_cookie) ?;
648- let redirect_target = validate_redirect_url ( redirect_target. to_string ( ) , & oidc_state. config . site_prefix ) ;
656+ let redirect_target =
657+ validate_redirect_url ( redirect_target. to_string ( ) , & oidc_state. config . site_prefix ) ;
649658
650659 log:: info!( "Redirecting to {redirect_target} after a successful login" ) ;
651660 let mut response = build_redirect_response ( redirect_target) ;
@@ -889,28 +898,28 @@ fn make_oidc_client(
889898 let client_id = openidconnect:: ClientId :: new ( config. client_id . clone ( ) ) ;
890899 let client_secret = openidconnect:: ClientSecret :: new ( config. client_secret . clone ( ) ) ;
891900
892- let redirect_path = format ! ( "{}{}" , config. site_prefix. trim_end_matches( '/' ) , SQLPAGE_REDIRECT_URI ) ;
893- let mut redirect_url = RedirectUrl :: new ( format ! (
894- "https://{}{}" ,
895- config. app_host, redirect_path,
896- ) )
897- . with_context ( || {
898- format ! (
899- "Failed to build the redirect URL; invalid app host \" {}\" " ,
900- config. app_host
901- )
902- } ) ?;
901+ let redirect_path = format ! (
902+ "{}{}" ,
903+ config. site_prefix. trim_end_matches( '/' ) ,
904+ SQLPAGE_REDIRECT_URI
905+ ) ;
906+ let mut redirect_url =
907+ RedirectUrl :: new ( format ! ( "https://{}{}" , config. app_host, redirect_path, ) ) . with_context (
908+ || {
909+ format ! (
910+ "Failed to build the redirect URL; invalid app host \" {}\" " ,
911+ config. app_host
912+ )
913+ } ,
914+ ) ?;
903915 let needs_http = match redirect_url. url ( ) . host ( ) {
904916 Some ( openidconnect:: url:: Host :: Domain ( domain) ) => domain == "localhost" ,
905917 Some ( openidconnect:: url:: Host :: Ipv4 ( _) | openidconnect:: url:: Host :: Ipv6 ( _) ) => true ,
906918 None => false ,
907919 } ;
908920 if needs_http {
909921 log:: debug!( "App host seems to be local, changing redirect URL to HTTP" ) ;
910- redirect_url = RedirectUrl :: new ( format ! (
911- "http://{}{}" ,
912- config. app_host, redirect_path,
913- ) ) ?;
922+ redirect_url = RedirectUrl :: new ( format ! ( "http://{}{}" , config. app_host, redirect_path, ) ) ?;
914923 }
915924 log:: info!( "OIDC redirect URL for {}: {redirect_url}" , config. client_id) ;
916925 let client =
@@ -1084,7 +1093,11 @@ impl AudienceVerifier {
10841093
10851094/// Validate that a redirect URL is safe to use (prevents open redirect attacks)
10861095fn validate_redirect_url ( url : String , site_prefix : & str ) -> String {
1087- let redirect_uri = format ! ( "{}{}" , site_prefix. trim_end_matches( '/' ) , SQLPAGE_REDIRECT_URI ) ;
1096+ let redirect_uri = format ! (
1097+ "{}{}" ,
1098+ site_prefix. trim_end_matches( '/' ) ,
1099+ SQLPAGE_REDIRECT_URI
1100+ ) ;
10881101 if url. starts_with ( '/' ) && !url. starts_with ( "//" ) && !url. starts_with ( & redirect_uri) {
10891102 return url;
10901103 }
0 commit comments