fix(auth): prevent open redirect on OIDC login returnUrl (port to main) by sfmskywalker · Pull Request #8585 · elsa-workflows/elsa-core

fix(auth): prevent open redirect on OIDC login returnUrl

sfmskywalker

committed

1b56812

fix(auth): harden remaining Studio return-URL sinks

sfmskywalker

committed

2baaeb2

fix(auth): normalize WASM OIDC return paths after decode

sfmskywalker

committed

0fe7667

fix(auth): preserve original return URLs after local validation

sfmskywalker

committed

e706b13

test(auth): share LocalReturnPath corpus with LoginChooserTests

sfmskywalker

committed

25bcaeb

test(auth): share LocalReturnPath corpus with WASM return-path tests

sfmskywalker

committed

22ba96d

fix(auth): accept only rooted local return paths

sfmskywalker

committed

4291270

fix(auth): root ElsaLogin and ElsaIdentity return paths against PathBase

sfmskywalker

committed

faff1aa

test(auth): cover relative LocalRedirect sinks with a real UrlHelper

sfmskywalker

committed

9c066d4

Navigation Menu

Repository navigation

fix(auth): prevent open redirect on OIDC login returnUrl (port to main) - #8585

fix(auth): prevent open redirect on OIDC login returnUrl (port to main)#8585
sfmskywalker merged 9 commits into
mainfrom
cursor/fix-oidc-open-redirect-main-17a8

Commits on Oct 3, 2026

fix(auth): prevent open redirect on OIDC login returnUrl

fix(auth): harden remaining Studio return-URL sinks

fix(auth): normalize WASM OIDC return paths after decode

fix(auth): preserve original return URLs after local validation

test(auth): share LocalReturnPath corpus with LoginChooserTests

test(auth): share LocalReturnPath corpus with WASM return-path tests

fix(auth): accept only rooted local return paths

fix(auth): root ElsaLogin and ElsaIdentity return paths against PathBase

test(auth): cover relative LocalRedirect sinks with a real UrlHelper