Vikrant Gupta 253ca7dd7e fix(session): validate ref and callback state against global allowed_origins (#12172) ...

* fix(session): use global external_url instead of ref param for SSO state

The sessions/context endpoint no longer reads the client-controlled ref
query param to build the SSO state and callback URLs. Each callback
authn provider now derives the site URL from the server-configured
global external_url, and siteURL is removed from the CallbackAuthN and
session Module interfaces.

* fix(session): validate ref and callback state against global allowed_origins

Instead of deriving SSO urls from the global external_url, keep the ref
roundtrip and validate its origin against the new optional
global.allowed_origins config. The callback state url is re-validated
before tokens are attached to it, closing the forged RelayState/state
exfiltration path. When allowed_origins is not configured, redirect
targets are not validated, preserving existing installs.

* fix(session): scope ref origin validation to sso auth domains

Move the allowed_origins check from the sessions/context handler to
getOrgSessionContext, right before the SSO login URL is built. A
disallowed ref no longer fails the whole request; only orgs with an
SSO-enabled auth domain get a per-org warning with password fallback.

2026-07-21 10:28:49 +00:00

..

handler.go

fix(authn): include base path in SSO callback and error-redirect URLs (#11588)

2026-06-08 14:15:04 +00:00

module.go

fix(session): validate ref and callback state against global allowed_origins (#12172)

2026-07-21 10:28:49 +00:00