Harden signin redirects while preserving native client schemes

BFF/v2/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js

@@ -1 +1,31 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+"use strict";
+
+(function () {
+  var meta = document.querySelector("meta[http-equiv=refresh]");
+  if (!meta) {
+    console.error("Could not find meta tag for signin redirect.");
+    return;
+  }
+
+  var redirectUrl = meta.getAttribute("data-url");
+  if (!redirectUrl || !redirectUrl.trim()) {
+    console.error("No signin redirect URL found in meta tag.");
+    return;
+  }
+
+  var url;
+  try {
+    url = new URL(redirectUrl, window.location.href);
+  } catch (error) {
+    console.error("Invalid signin redirect URL.", error);
+    return;
+  }
+
+  // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S).
+  if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") {
+    console.error("Signin redirect URL has an unsafe scheme.");
+    return;
+  }
+
+  window.location.href = url.href;
+})();

BFF/v3/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js

@@ -1 +1,31 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+"use strict";
+
+(function () {
+  var meta = document.querySelector("meta[http-equiv=refresh]");
+  if (!meta) {
+    console.error("Could not find meta tag for signin redirect.");
+    return;
+  }
+
+  var redirectUrl = meta.getAttribute("data-url");
+  if (!redirectUrl || !redirectUrl.trim()) {
+    console.error("No signin redirect URL found in meta tag.");
+    return;
+  }
+
+  var url;
+  try {
+    url = new URL(redirectUrl, window.location.href);
+  } catch (error) {
+    console.error("Invalid signin redirect URL.", error);
+    return;
+  }
+
+  // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S).
+  if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") {
+    console.error("Signin redirect URL has an unsafe scheme.");
+    return;
+  }
+
+  window.location.href = url.href;
+})();

BFF/v3/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js

@@ -1,30 +1,31 @@
 "use strict";
 
-/**
- * Performs automatic redirect back to the native client application after signin.
- */
 (function () {
   var meta = document.querySelector("meta[http-equiv=refresh]");
   if (!meta) {
     console.error("Could not find meta tag for signin redirect.");
     return;
   }
 
-  var url = meta.getAttribute("data-url");
-  if (!url) {
+  var redirectUrl = meta.getAttribute("data-url");
+  if (!redirectUrl || !redirectUrl.trim()) {
     console.error("No signin redirect URL found in meta tag.");
     return;
   }
 
-  // *** Protocol Validation (https://codeql.github.com/codeql-query-help/javascript/js-xss-through-dom/)  ***
-  // Ensure the URL starts with http: or https: to prevent potential XSS via javascript: URIs
-  // Convert to lowercase for case-insensitive comparison.
-  var lowerUrl = url.toLowerCase();
-  if (!lowerUrl.startsWith("http:") && !lowerUrl.startsWith("https:")) {
-    console.error("Signin redirect URL has an invalid scheme:", url);
+  var url;
+  try {
+    url = new URL(redirectUrl, window.location.href);
+  } catch (error) {
+    console.error("Invalid signin redirect URL.", error);
     return;
   }
 
-  // If the URL is valid (for web), perform the redirect
-  window.location.href = url;
+  // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S).
+  if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") {
+    console.error("Signin redirect URL has an unsafe scheme.");
+    return;
+  }
+
+  window.location.href = url.href;
 })();

BFF/v4/MultiFrontendSSO/MultiFrontendSSO.Client/wwwroot/js/signin-redirect.js

@@ -1 +1,31 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+"use strict";
+
+(function () {
+  var meta = document.querySelector("meta[http-equiv=refresh]");
+  if (!meta) {
+    console.error("Could not find meta tag for signin redirect.");
+    return;
+  }
+
+  var redirectUrl = meta.getAttribute("data-url");
+  if (!redirectUrl || !redirectUrl.trim()) {
+    console.error("No signin redirect URL found in meta tag.");
+    return;
+  }
+
+  var url;
+  try {
+    url = new URL(redirectUrl, window.location.href);
+  } catch (error) {
+    console.error("Invalid signin redirect URL.", error);
+    return;
+  }
+
+  // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S).
+  if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") {
+    console.error("Signin redirect URL has an unsafe scheme.");
+    return;
+  }
+
+  window.location.href = url.href;
+})();

BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/idsrv-wwwroot/js/signin-redirect.js

@@ -1 +1,31 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+"use strict";
+
+(function () {
+  var meta = document.querySelector("meta[http-equiv=refresh]");
+  if (!meta) {
+    console.error("Could not find meta tag for signin redirect.");
+    return;
+  }
+
+  var redirectUrl = meta.getAttribute("data-url");
+  if (!redirectUrl || !redirectUrl.trim()) {
+    console.error("No signin redirect URL found in meta tag.");
+    return;
+  }
+
+  var url;
+  try {
+    url = new URL(redirectUrl, window.location.href);
+  } catch (error) {
+    console.error("Invalid signin redirect URL.", error);
+    return;
+  }
+
+  // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S).
+  if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") {
+    console.error("Signin redirect URL has an unsafe scheme.");
+    return;
+  }
+
+  window.location.href = url.href;
+})();

BFF/v4/TokenExchange/TokenExchange.IdentityServer/wwwroot/js/signin-redirect.js

@@ -1 +1,31 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+"use strict";
+
+(function () {
+  var meta = document.querySelector("meta[http-equiv=refresh]");
+  if (!meta) {
+    console.error("Could not find meta tag for signin redirect.");
+    return;
+  }
+
+  var redirectUrl = meta.getAttribute("data-url");
+  if (!redirectUrl || !redirectUrl.trim()) {
+    console.error("No signin redirect URL found in meta tag.");
+    return;
+  }
+
+  var url;
+  try {
+    url = new URL(redirectUrl, window.location.href);
+  } catch (error) {
+    console.error("Invalid signin redirect URL.", error);
+    return;
+  }
+
+  // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S).
+  if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") {
+    console.error("Signin redirect URL has an unsafe scheme.");
+    return;
+  }
+
+  window.location.href = url.href;
+})();

BFF/v4/docker/ContainerizedIdentityServer/wwwroot/js/signin-redirect.js

@@ -1,30 +1,31 @@
 "use strict";
 
-/**
- * Performs automatic redirect back to the native client application after signin.
- */
 (function () {
   var meta = document.querySelector("meta[http-equiv=refresh]");
   if (!meta) {
     console.error("Could not find meta tag for signin redirect.");
     return;
   }
 
-  var url = meta.getAttribute("data-url");
-  if (!url) {
+  var redirectUrl = meta.getAttribute("data-url");
+  if (!redirectUrl || !redirectUrl.trim()) {
     console.error("No signin redirect URL found in meta tag.");
     return;
   }
 
-  // *** Protocol Validation (https://codeql.github.com/codeql-query-help/javascript/js-xss-through-dom/)  ***
-  // Ensure the URL starts with http: or https: to prevent potential XSS via javascript: URIs
-  // Convert to lowercase for case-insensitive comparison.
-  var lowerUrl = url.toLowerCase();
-  if (!lowerUrl.startsWith("http:") && !lowerUrl.startsWith("https:")) {
-    console.error("Signin redirect URL has an invalid scheme:", url);
+  var url;
+  try {
+    url = new URL(redirectUrl, window.location.href);
+  } catch (error) {
+    console.error("Invalid signin redirect URL.", error);
     return;
   }
 
-  // If the URL is valid (for web), perform the redirect
-  window.location.href = url;
+  // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S).
+  if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") {
+    console.error("Signin redirect URL has an unsafe scheme.");
+    return;
+  }
+
+  window.location.href = url.href;
 })();

IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/wwwroot/js/signin-redirect.js

@@ -1 +1,31 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+"use strict";
+
+(function () {
+  var meta = document.querySelector("meta[http-equiv=refresh]");
+  if (!meta) {
+    console.error("Could not find meta tag for signin redirect.");
+    return;
+  }
+
+  var redirectUrl = meta.getAttribute("data-url");
+  if (!redirectUrl || !redirectUrl.trim()) {
+    console.error("No signin redirect URL found in meta tag.");
+    return;
+  }
+
+  var url;
+  try {
+    url = new URL(redirectUrl, window.location.href);
+  } catch (error) {
+    console.error("Invalid signin redirect URL.", error);
+    return;
+  }
+
+  // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S).
+  if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") {
+    console.error("Signin redirect URL has an unsafe scheme.");
+    return;
+  }
+
+  window.location.href = url.href;
+})();

IdentityServer/v7/Configuration/IdentityServerHost/wwwroot/js/signin-redirect.js

@@ -1 +1,31 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+"use strict";
+
+(function () {
+  var meta = document.querySelector("meta[http-equiv=refresh]");
+  if (!meta) {
+    console.error("Could not find meta tag for signin redirect.");
+    return;
+  }
+
+  var redirectUrl = meta.getAttribute("data-url");
+  if (!redirectUrl || !redirectUrl.trim()) {
+    console.error("No signin redirect URL found in meta tag.");
+    return;
+  }
+
+  var url;
+  try {
+    url = new URL(redirectUrl, window.location.href);
+  } catch (error) {
+    console.error("Invalid signin redirect URL.", error);
+    return;
+  }
+
+  // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S).
+  if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") {
+    console.error("Signin redirect URL has an unsafe scheme.");
+    return;
+  }
+
+  window.location.href = url.href;
+})();

IdentityServer/v7/Diagnostics/Aspire/IdentityServer/wwwroot/js/signin-redirect.js

@@ -1 +1,31 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+"use strict";
+
+(function () {
+  var meta = document.querySelector("meta[http-equiv=refresh]");
+  if (!meta) {
+    console.error("Could not find meta tag for signin redirect.");
+    return;
+  }
+
+  var redirectUrl = meta.getAttribute("data-url");
+  if (!redirectUrl || !redirectUrl.trim()) {
+    console.error("No signin redirect URL found in meta tag.");
+    return;
+  }
+
+  var url;
+  try {
+    url = new URL(redirectUrl, window.location.href);
+  } catch (error) {
+    console.error("Invalid signin redirect URL.", error);
+    return;
+  }
+
+  // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S).
+  if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") {
+    console.error("Signin redirect URL has an unsafe scheme.");
+    return;
+  }
+
+  window.location.href = url.href;
+})();

IdentityServer/v7/Diagnostics/Otel/src/wwwroot/js/signin-redirect.js

@@ -1 +1,31 @@
-window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");
+"use strict";
+
+(function () {
+  var meta = document.querySelector("meta[http-equiv=refresh]");
+  if (!meta) {
+    console.error("Could not find meta tag for signin redirect.");
+    return;
+  }
+
+  var redirectUrl = meta.getAttribute("data-url");
+  if (!redirectUrl || !redirectUrl.trim()) {
+    console.error("No signin redirect URL found in meta tag.");
+    return;
+  }
+
+  var url;
+  try {
+    url = new URL(redirectUrl, window.location.href);
+  } catch (error) {
+    console.error("Invalid signin redirect URL.", error);
+    return;
+  }
+
+  // Native clients may use custom schemes, so block dangerous schemes rather than allow only HTTP(S).
+  if (url.protocol === "javascript:" || url.protocol === "data:" || url.protocol === "vbscript:") {
+    console.error("Signin redirect URL has an unsafe scheme.");
+    return;
+  }
+
+  window.location.href = url.href;
+})();