🐛 allow creating local apps with unsecure schemes

app/Rules/SecureUrl.php

@@ -18,8 +18,45 @@ class SecureUrl implements InvokableRule
      */
     public function __invoke($attribute, $value, $fail)
     {
-        if (!str_starts_with($value, 'https://') && !App::environment('local')) {
-            $fail(':attribute must be a secure URL.');
+        if (str_starts_with($value, 'https://')) {
+            return;
         }
+
+        if (App::environment('local') || $this->isLoopbackUrl($value)) {
+            return;
+        }
+
+        $fail(':attribute must be a secure URL.');
+    }
+
+    /**
+     * RFC 8252 Nr. 8.3
+     */
+    private function isLoopbackUrl(string $value): bool
+    {
+        if (!str_starts_with($value, 'http://')) {
+            return false;
+        }
+
+        $host = parse_url($value, PHP_URL_HOST);
+        if ($host === null || $host === false) {
+            return false;
+        }
+
+        $host = trim($host, '[]');
+
+        if ($host === 'localhost' || str_ends_with($host, '.localhost')) {
+            return true;
+        }
+
+        if ($host === '::1') {
+            return true;
+        }
+
+        if (filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+            return str_starts_with($host, '127.');
+        }
+
+        return false;
     }
 }

resources/tailwind-app/pages/Settings/Applications/partials/ApplicationForm.vue

@@ -69,21 +69,13 @@ async function submit() {
     };
 
     try {
-        let response;
-        if (props.app) {
-            response = await api.applications.updateApplication(props.app.id, payload);
-        } else {
-            response = await api.applications.createApplication(payload);
-        }
-
-        if (response.status === 422) {
-            const data = await response.json();
-            errors.value = data.errors ?? {};
-            return;
-        }
-
-        const data = await response.json();
-        emit('saved', data.data, data.data?.plainSecret);
+        const response = props.app
+            ? await api.applications.updateApplication(props.app.id, payload)
+            : await api.applications.createApplication(payload);
+
+        emit('saved', response.data.data, response.data.data?.plainSecret);
+    } catch (e) {
+        errors.value = (e as { error?: { errors?: Record<string, string[]> } })?.error?.errors ?? {};
     } finally {
         saving.value = false;
     }

tests/Feature/APIv1/ApplicationCrudTest.php

@@ -6,6 +6,7 @@
 
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use PHPUnit\Framework\Attributes\DataProvider;
 use Tests\ApiTestCase;
 
 class ApplicationCrudTest extends ApiTestCase
@@ -75,18 +76,37 @@ public function test_create_application_validates_required_fields(): void
         $response->assertJsonValidationErrors(['name', 'redirect']);
     }
 
-    public function test_create_application_validates_https_redirect_url(): void
+    public static function redirectUrlProvider(): array
+    {
+        return [
+            'https allowed' => ['https://example.com/callback', true],
+            'plain http rejected' => ['http://example.com/callback', false],
+            'localhost' => ['http://localhost:8710/callback', true],
+            'localhost subdomain' => ['http://app.localhost/callback', true],
+            'ipv4 loopback' => ['http://127.0.0.1:8710/callback', true],
+            'ipv4 loopback subnet' => ['http://127.1.2.3/callback', true],
+            'ipv6 loopback' => ['http://[::1]:8710/callback', true],
+        ];
+    }
+
+    #[DataProvider('redirectUrlProvider')]
+    public function test_create_application_validates_redirect_url_scheme(string $redirect, bool $allowed): void
     {
         $user = User::factory()->create();
         $this->actAsApiUserWithAllScopes($user);
 
         $response = $this->postJson('/api/v1/applications', [
             'name' => 'App',
-            'redirect' => 'http://example.com/callback',
+            'redirect' => $redirect,
         ]);
 
-        $response->assertUnprocessable();
-        $response->assertJsonValidationErrors(['redirect']);
+        if ($allowed) {
+            $response->assertCreated();
+            $response->assertJsonPath('data.redirect', $redirect);
+        } else {
+            $response->assertUnprocessable();
+            $response->assertJsonValidationErrors(['redirect']);
+        }
     }
 
     public function test_create_application_returns_plain_secret_for_confidential(): void