[petruki]

This pull request introduces a new environment variable, OAUTH_ALLOWED_REDIRECT_HOSTS, to restrict which hostnames can be used as OAuth client redirect URIs for registration and authorization. The change enhances security by allowing administrators to specify a comma-separated allow-list of hosts, with loopback addresses always permitted. The implementation includes code changes, documentation updates, and new tests to cover the feature.

OAuth Redirect Host Allow-List Feature:

• Added the OAUTH_ALLOWED_REDIRECT_HOSTS environment variable to .env-cmdrc-template, config/.env.dev, and docker-compose.yml to configure allowed OAuth redirect hosts. [1] [2] [3]
• Updated the OAuth service (src/services/oauth.js) to enforce the allow-list: only hosts in OAUTH_ALLOWED_REDIRECT_HOSTS or loopback addresses are accepted for redirect_uri during client registration and authorization. [1] [2]

Documentation:

• Updated README.md to explain the usage and behavior of OAUTH_ALLOWED_REDIRECT_HOSTS, including default behavior and examples.

Testing:

• Added tests in tests/oauth.test.js to verify correct enforcement of the allow-list during OAuth client registration and authorization flows.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud