Merge branch 'dev'

damienbod · Dec 31, 2023 · a12f43d · a12f43d
2 parents ef999bd + 729cf12
commit a12f43d
Showing 1 changed file with 26 additions and 2 deletions.
diff --git a/content/BlazorBffAzureAD/Server/Controllers/AccountController.cs b/content/BlazorBffAzureAD/Server/Controllers/AccountController.cs
@@ -15,9 +15,8 @@ public ActionResult Login(string? returnUrl, string? claimsChallenge)
     {
         // var claims = "{\"access_token\":{\"acrs\":{\"essential\":true,\"value\":\"c1\"}}}";
         // var claims = "{\"id_token\":{\"acrs\":{\"essential\":true,\"value\":\"c1\"}}}";
-        var redirectUri = !string.IsNullOrEmpty(returnUrl) ? returnUrl : "/";
 
-        var properties = new AuthenticationProperties { RedirectUri = redirectUri };
+        var properties = GetAuthProperties(returnUrl);
 
         if(claimsChallenge != null)
         {
@@ -40,4 +39,29 @@ public IActionResult Logout()
             CookieAuthenticationDefaults.AuthenticationScheme,
             OpenIdConnectDefaults.AuthenticationScheme);
     }
+
+    /// <summary>
+    /// Original src:
+    /// https://github.com/dotnet/blazor-samples/blob/main/8.0/BlazorWebOidc/BlazorWebOidc/LoginLogoutEndpointRouteBuilderExtensions.cs
+    /// </summary>
+    private static AuthenticationProperties GetAuthProperties(string? returnUrl)
+    {
+        const string pathBase = "/";
+
+        // Prevent open redirects.
+        if (string.IsNullOrEmpty(returnUrl))
+        {
+            returnUrl = pathBase;
+        }
+        else if (!Uri.IsWellFormedUriString(returnUrl, UriKind.Relative))
+        {
+            returnUrl = new Uri(returnUrl, UriKind.Absolute).PathAndQuery;
+        }
+        else if (returnUrl[0] != '/')
+        {
+            returnUrl = $"{pathBase}{returnUrl}";
+        }
+
+        return new AuthenticationProperties { RedirectUri = returnUrl };
+    }
 }