From 681e5ad7ed143783ed93086efa9bd9a7e592827d Mon Sep 17 00:00:00 2001
From: Damian Hickey <dhickey@gmail.com>
Date: Tue, 27 Oct 2026 09:14:10 +0100
Subject: [PATCH] Encode logout id in WsFed remote-failure redirect

The OnRemoteFailure handler redirected to the local logout page with the
raw logoutId query value appended. URL-encode it via QueryString.Create
so request input cannot alter the redirect target (CodeQL
cs/web/unvalidated-url-redirection).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---
 .../IdentityServerHost/WsFed/WsFedConfigureOptions.cs        | 5 ++++-
 .../IdentityServerHost/WsFed/WsFedConfigureOptions.cs        | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs b/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs
index ef34f792b..72aa56d91 100755
--- a/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs
+++ b/IdentityServer/v7/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs
@@ -66,7 +66,10 @@ protected override void Configure(ConfigureAuthenticationContext<WsFederationOpt
                 ctx.Request.Path == ctx.Options.CallbackPath &&
                 ctx.Request.Query.ContainsKey(identityServerOptions.UserInteraction.LogoutIdParameter))
             {
-                ctx.Response.Redirect(identityServerOptions.UserInteraction.LogoutUrl + "?" + identityServerOptions.UserInteraction.LogoutIdParameter + "=" + ctx.Request.Query[identityServerOptions.UserInteraction.LogoutIdParameter]);
+                // Redirect only to the local logout page; the logout id is URL-encoded so it cannot alter the target.
+                var logoutId = ctx.Request.Query[identityServerOptions.UserInteraction.LogoutIdParameter].ToString();
+                var query = QueryString.Create(identityServerOptions.UserInteraction.LogoutIdParameter, logoutId);
+                ctx.Response.Redirect(identityServerOptions.UserInteraction.LogoutUrl + query.ToUriComponent());
                 ctx.HandleResponse();
             }
 
diff --git a/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs b/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs
index ef34f792b..72aa56d91 100755
--- a/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs
+++ b/IdentityServer/v8/UserInteraction/WsFederationDynamicProviders/IdentityServerHost/WsFed/WsFedConfigureOptions.cs
@@ -66,7 +66,10 @@ protected override void Configure(ConfigureAuthenticationContext<WsFederationOpt
                 ctx.Request.Path == ctx.Options.CallbackPath &&
                 ctx.Request.Query.ContainsKey(identityServerOptions.UserInteraction.LogoutIdParameter))
             {
-                ctx.Response.Redirect(identityServerOptions.UserInteraction.LogoutUrl + "?" + identityServerOptions.UserInteraction.LogoutIdParameter + "=" + ctx.Request.Query[identityServerOptions.UserInteraction.LogoutIdParameter]);
+                // Redirect only to the local logout page; the logout id is URL-encoded so it cannot alter the target.
+                var logoutId = ctx.Request.Query[identityServerOptions.UserInteraction.LogoutIdParameter].ToString();
+                var query = QueryString.Create(identityServerOptions.UserInteraction.LogoutIdParameter, logoutId);
+                ctx.Response.Redirect(identityServerOptions.UserInteraction.LogoutUrl + query.ToUriComponent());
                 ctx.HandleResponse();
             }