web: relax OAuth consent page redirect URI validation#13926
Conversation
Only block dangerous schemes (javascript:, data:, vbscript:) on the client. All other validation (allowed domains, path, etc.) is enforced server-side via the registered redirect URI list, making the redundant client-side checks an obstacle for custom URI scheme redirects required by native apps (e.g. myapp://oauth/callback). Minor CSS layout fix in OAuthLoginPage.module.css. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates the web OAuth consent flow to allow additional redirect URI schemes (to support native app OAuth callbacks) while keeping basic client-side protection against script-executing URI schemes, and adjusts consent page layout styling.
Changes:
- Relax
getIsRedirectValidto only rejectjavascript:,data:, andvbscript:redirect schemes. - Remove other client-side redirect URI constraints (http/https-only, IP checks, path traversal checks).
- Adjust consent wrapper styling to vertically center content and use
overflow: auto.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
packages/web/src/pages/oauth-login-page/utils.ts |
Relaxes redirect URI validation logic used by OAuth login/pay flows. |
packages/web/src/pages/oauth-login-page/OAuthLoginPage.module.css |
Tweaks wrapper flex/overflow and adds auto block margins for vertical centering. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
🌐 Web preview readyPreview URL: https://audius-web-preview-pr-13926.audius.workers.dev Unique preview for this PR (deployed from this branch). |
|
Stricter validation was moved to the server: AudiusProject/api#721 |
Summary
getIsRedirectValidto only block dangerous schemes (javascript:,data:,vbscript:). All other validation is enforced server-side against the registered redirect URI list.myapp://oauth/callback) required for native app OAuth flows.OAuthLoginPage.module.cssto vertically center the consent card.Test plan
myapp://) are no longer blocked by the consent pagejavascript:,data:,vbscript:URIs are still rejectedhttps://redirect URIs still work🤖 Generated with Claude Code