From 281dbd96398d9f850c1c8df5b61d75b5297445a4 Mon Sep 17 00:00:00 2001 From: Nelson Susanto Date: Fri, 29 Apr 2022 10:59:15 +1000 Subject: [PATCH 1/4] Use request.host instead of header host --- .../Web/UserAuthenticatedPkceAction.cs | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs b/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs index 7ddbd4a..f89e22c 100644 --- a/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs +++ b/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs @@ -80,8 +80,7 @@ public async Task ExecuteAsync(IOctoRequest request) async Task Handle(string code, string state, IOctoRequest request) { - var host = request.Headers.ContainsKey("Host") ? request.Headers["Host"].Single() : request.Host; - var redirectUri = $"{request.Scheme}://{host}{configurationStore.RedirectUri}"; + var redirectUri = $"{request.Scheme}://{request.Host}{configurationStore.RedirectUri}"; var stateFromRequest = JsonConvert.DeserializeObject(state)!; using var cts = new CancellationTokenSource(TimeSpan.FromMinutes(1)); From 8de1a6cab50bf7dd43f11d572eafa27e8c96d2b8 Mon Sep 17 00:00:00 2001 From: Nelson Susanto Date: Fri, 29 Apr 2022 13:33:40 +1000 Subject: [PATCH 2/4] more testing --- .../Web/UserAuthenticatedPkceAction.cs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs b/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs index f89e22c..a62ae4a 100644 --- a/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs +++ b/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs @@ -81,6 +81,8 @@ public async Task ExecuteAsync(IOctoRequest request) async Task Handle(string code, string state, IOctoRequest request) { var redirectUri = $"{request.Scheme}://{request.Host}{configurationStore.RedirectUri}"; + var headersHost = request.Headers["Host"].Single(); + return UserAuthenticatedValidator.BadRequest(log, $"redirectUri: {redirectUri}, headers host: {headersHost}"); var stateFromRequest = JsonConvert.DeserializeObject(state)!; using var cts = new CancellationTokenSource(TimeSpan.FromMinutes(1)); From f6d91a01e1fead792512888543b49ba06d11daea Mon Sep 17 00:00:00 2001 From: Nelson Susanto Date: Mon, 2 May 2022 15:11:09 +1000 Subject: [PATCH 3/4] More logs --- .../Web/UserAuthenticatedPkceAction.cs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs b/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs index a62ae4a..3411d8e 100644 --- a/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs +++ b/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs @@ -80,10 +80,10 @@ public async Task ExecuteAsync(IOctoRequest request) async Task Handle(string code, string state, IOctoRequest request) { + var stateFromRequest = JsonConvert.DeserializeObject(state)!; var redirectUri = $"{request.Scheme}://{request.Host}{configurationStore.RedirectUri}"; var headersHost = request.Headers["Host"].Single(); - return UserAuthenticatedValidator.BadRequest(log, $"redirectUri: {redirectUri}, headers host: {headersHost}"); - var stateFromRequest = JsonConvert.DeserializeObject(state)!; + return UserAuthenticatedValidator.BadRequest(log, $"redirectUri: {redirectUri}, headers host: {headersHost}, usingSecuredConnection: {stateFromRequest.UsingSecureConnection}, isHttps: {request.IsHttps}"); using var cts = new CancellationTokenSource(TimeSpan.FromMinutes(1)); var codeVerifier = await GetCodeVerifier(stateFromRequest.RequestId, cts.Token); From 9066a7576b1dea8c89841c109f7e770a38210fe2 Mon Sep 17 00:00:00 2001 From: Nelson Susanto Date: Tue, 3 May 2022 15:08:58 +1000 Subject: [PATCH 4/4] Calculate scheme from UsingSecureConnection --- .../Web/UserAuthenticatedPkceAction.cs | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs b/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs index 3411d8e..25f8347 100644 --- a/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs +++ b/source/Server.OpenIDConnect.Common/Web/UserAuthenticatedPkceAction.cs @@ -81,10 +81,11 @@ public async Task ExecuteAsync(IOctoRequest request) async Task Handle(string code, string state, IOctoRequest request) { var stateFromRequest = JsonConvert.DeserializeObject(state)!; - var redirectUri = $"{request.Scheme}://{request.Host}{configurationStore.RedirectUri}"; - var headersHost = request.Headers["Host"].Single(); - return UserAuthenticatedValidator.BadRequest(log, $"redirectUri: {redirectUri}, headers host: {headersHost}, usingSecuredConnection: {stateFromRequest.UsingSecureConnection}, isHttps: {request.IsHttps}"); - + + var host = request.Headers.ContainsKey("Host") ? request.Headers["Host"].Single() : request.Host; + var scheme = stateFromRequest.UsingSecureConnection ? "https" : "http"; + var redirectUri = $"{scheme}://{host}{configurationStore.RedirectUri}"; + using var cts = new CancellationTokenSource(TimeSpan.FromMinutes(1)); var codeVerifier = await GetCodeVerifier(stateFromRequest.RequestId, cts.Token); var response = await RequestAuthToken(code, redirectUri, codeVerifier);