Harden signin redirects while preserving native client schemes by damianh · Pull Request #407 · DuendeSoftware/samples

damianh · 2026-10-27T08:13:40Z

Summary

Use one byte-identical implementation in all 58 signin-redirect.js copies, including the two BFF docker copies that previously allowed only HTTP(S).
Parse redirect targets with new URL(redirectUrl, window.location.href), reject normalized javascript:, data:, and vbscript: protocols, and navigate using the parsed URL's href.
Preserve native-client custom schemes and relative URLs; log an error and avoid navigation when the meta tag or URL is missing, blank, malformed, or uses a blocked scheme.

This batch targets the 35 open js/xss-through-dom alerts associated with signin-redirect.js. It deliberately does not restrict redirects to HTTP(S), since native clients can use schemes such as myapp://callback. Any residual CodeQL alerts will be evaluated separately rather than weakening native-client compatibility or adding scanner-specific workarounds.

Validation

Reproduced the original unsafe assignment using a mixed-case, whitespace-prefixed javascript: URI.
Ran 20 Node VM behavior cases against each of the 58 copies (1,160 passing cases): HTTP(S), native/custom schemes, relative URLs, URL normalization, blocked schemes including mixed-case/control-character variants, missing metadata, empty/blank attributes, and malformed URLs.
Confirmed all 58 copies are byte-identical and git diff --check passes.

Only signin-redirect.js files are changed.

Parse redirect URLs before denying javascript, data, and vbscript schemes. Handle absent and malformed redirect metadata and use the normalized URL for navigation in all 58 sample copies. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

maartenba · 2026-10-27T08:15:16Z

Note this needs updating in products too

Copilot

🟢 Approval recommended

The consistent implementation blocks normalized unsafe schemes while preserving intended redirects, with no blocking defects identified.

No open issues 🎉

What changed in this PR

This PR hardens sign-in redirects across 58 IdentityServer and BFF sample scripts while preserving native-client callbacks and relative URLs.

Changes:

Standardizes all copies on URL parsing and normalized blocking of javascript:, data:, and vbscript: schemes.
Stops navigation and logs errors for missing, blank, or malformed redirect targets.
Replaces the two Docker samples’ HTTP(S)-only restriction with native-compatible validation.

File	Description
various/clients/Owin/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds redirect validation to OWIN sample.
IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/SessionMigration/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/SAML/IdPInitiated/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/SAML/Basic/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v8/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v8/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v8/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v8/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v8/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v8/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v8/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/IdentityServerHost/src/wwwroot/js/signin-redirect.js	Hardens main sample host redirects.
IdentityServer/v8/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v8/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/UserInteraction/WindowsAuthentication/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/UserInteraction/StepUp/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/UserInteraction/SpaLoginUi/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/UserInteraction/ProfileService/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/UserInteraction/DynamicProviders/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/UserInteraction/Ciba/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/SessionMigration/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/SessionManagement/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/Quickstarts/6_JS_without_backend/src/IdentityServer/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v7/Quickstarts/6_JS_with_backend/src/IdentityServer/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v7/Quickstarts/5_AspNetIdentity/src/IdentityServerAspNetIdentity/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v7/Quickstarts/4_EntityFramework/src/IdentityServer/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v7/Quickstarts/3a_TokenManagement/src/IdentityServer/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v7/Quickstarts/3_AspNetCoreAndApis/src/IdentityServer/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v7/Quickstarts/2_InteractiveAspNetCore/src/IdentityServer/wwwroot/js/signin-redirect.js	Hardens quickstart redirects.
IdentityServer/v7/PAT/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/MTLS/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/McpDemo/McpDemo.IdentityServer/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/IdentityServerHost/src/wwwroot/js/signin-redirect.js	Hardens main sample host redirects.
IdentityServer/v7/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js	Adds shared redirect validation.
BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js	Hardens token-exchange sample redirects.
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/js/signin-redirect.js	Hardens SSO server redirects.
BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/js/signin-redirect.js	Hardens SSO client redirects.
BFF/v4/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js	Validates redirects while allowing native schemes.
BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js	Hardens token-exchange sample redirects.
BFF/v3/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js	Validates redirects while allowing native schemes.
BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js	Hardens token-exchange sample redirects.

_{Review effort: Balanced}

Copilot AI balanced review requested due to automatic review settings October 27, 2026 08:13

Copilot started reviewing on behalf of damianh October 27, 2026 08:14

View session

Copilot AI reviewed Oct 27, 2026

View reviewed changes

maartenba approved these changes Oct 27, 2026

View reviewed changes

maartenba merged commit 3c049ea into main Oct 27, 2026
105 checks passed

maartenba deleted the dh/harden-signin-redirect branch October 27, 2026 10:26

Navigation Menu

Repository navigation

Harden signin redirects while preserving native client schemes - #407

Harden signin redirects while preserving native client schemes#407
maartenba merged 1 commit into
mainfrom
dh/harden-signin-redirect

damianh commented Oct 27, 2026

Uh oh!

maartenba commented Oct 27, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

damianh commented Oct 27, 2026

Summary

Validation

Uh oh!

maartenba commented Oct 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants