Skip to content

Fix cs/log-forging alerts by stripping line endings before logging #409

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maartenba merged 2 commits into from
Oct 27, 2026
+326 −326
Merged

Fix cs/log-forging alerts by stripping line endings before logging #409

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8969115
Strip line endings from user-supplied values before logging
damianh Oct 27, 2026
6fd2700
Handle null id/returnUrl in Log helpers
damianh Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions BFF/v2/TokenExchange/TokenExchange.IdentityServer/Pages/Ciba/Consent.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ public async Task<IActionResult> OnPost()
var request = await _interaction.GetLoginRequestByInternalIdAsync(Input.Id);
if (request == null || request.Subject.GetSubjectId() != User.GetSubjectId())
{
_logger.LogError("Invalid id {id}", Input.Id);
_logger.LogError("Invalid id {id}", Input.Id?.ReplaceLineEndings(string.Empty));
return RedirectToPage("/Home/Error/Index");
}

Expand Down Expand Up @@ -124,7 +124,7 @@ private async Task<ViewModel> BuildViewModelAsync(string id, InputModel model =
}
else
{
_logger.LogError("No backchannel login request matching id: {id}", id);
_logger.LogError("No backchannel login request matching id: {id}", id?.ReplaceLineEndings(string.Empty));
}
return null;
}
Expand Down
2 changes: 1 addition & 1 deletion BFF/v2/TokenExchange/TokenExchange.IdentityServer/Pages/Ciba/Index.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ public async Task<IActionResult> OnGet(string id)
LoginRequest = await _backchannelAuthenticationInteraction.GetLoginRequestByInternalIdAsync(id);
if (LoginRequest == null)
{
_logger.LogWarning("Invalid backchannel login id {id}", id);
_logger.LogWarning("Invalid backchannel login id {id}", id?.ReplaceLineEndings(string.Empty));
return RedirectToPage("/home/error/index");
}

Expand Down
2 changes: 1 addition & 1 deletion BFF/v2/TokenExchange/TokenExchange.IdentityServer/Pages/Consent/Index.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ private async Task<ViewModel> BuildViewModelAsync(string returnUrl, InputModel m
}
else
{
_logger.LogError("No consent request matching request: {0}", returnUrl);
_logger.LogError("No consent request matching request: {returnUrl}", returnUrl?.ReplaceLineEndings(string.Empty));
}
return null;
}
Expand Down
4 changes: 2 additions & 2 deletions BFF/v3/TokenExchange/TokenExchange.IdentityServer/Pages/Ciba/Consent.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ public async Task<IActionResult> OnPost()
var request = await _interaction.GetLoginRequestByInternalIdAsync(Input.Id);
if (request == null || request.Subject.GetSubjectId() != User.GetSubjectId())
{
_logger.LogError("Invalid id {id}", Input.Id);
_logger.LogError("Invalid id {id}", Input.Id?.ReplaceLineEndings(string.Empty));
return RedirectToPage("/Home/Error/Index");
}

Expand Down Expand Up @@ -124,7 +124,7 @@ private async Task<ViewModel> BuildViewModelAsync(string id, InputModel model =
}
else
{
_logger.LogError("No backchannel login request matching id: {id}", id);
_logger.LogError("No backchannel login request matching id: {id}", id?.ReplaceLineEndings(string.Empty));
}
return null;
}
Expand Down
2 changes: 1 addition & 1 deletion BFF/v3/TokenExchange/TokenExchange.IdentityServer/Pages/Ciba/Index.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ public async Task<IActionResult> OnGet(string id)
LoginRequest = await _backchannelAuthenticationInteraction.GetLoginRequestByInternalIdAsync(id);
if (LoginRequest == null)
{
_logger.LogWarning("Invalid backchannel login id {id}", id);
_logger.LogWarning("Invalid backchannel login id {id}", id?.ReplaceLineEndings(string.Empty));
return RedirectToPage("/home/error/index");
}

Expand Down
2 changes: 1 addition & 1 deletion BFF/v3/TokenExchange/TokenExchange.IdentityServer/Pages/Consent/Index.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ private async Task<ViewModel> BuildViewModelAsync(string returnUrl, InputModel m
}
else
{
_logger.LogError("No consent request matching request: {0}", returnUrl);
_logger.LogError("No consent request matching request: {returnUrl}", returnUrl?.ReplaceLineEndings(string.Empty));
}
return null;
}
Expand Down
2 changes: 1 addition & 1 deletion BFF/v3/docker/ContainerizedIdentityServer/Pages/Account/Logout/LoggedOut.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ public LoggedOut(IIdentityServerInteractionService interactionService, ILogger<L

public async Task OnGet(string? logoutId)
{
_logger.LogInformation("LoggedOut page OnGet called with logoutId: {LogoutId}", logoutId);
_logger.LogInformation("LoggedOut page OnGet called with logoutId: {LogoutId}", logoutId?.ReplaceLineEndings(string.Empty));

// Log the value configured in LogoutOptions
_logger.LogInformation("LogoutOptions.AutomaticRedirectAfterSignOut value is: {AutoRedirect}", LogoutOptions.AutomaticRedirectAfterSignOut);
Expand Down
16 changes: 8 additions & 8 deletions BFF/v3/docker/ContainerizedIdentityServer/Pages/Log.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ internal static class Log

public static void InvalidId(this ILogger logger, string? id)
{
_invalidId(logger, id, null);
_invalidId(logger, id?.ReplaceLineEndings(string.Empty), null);
}

private static readonly Action<ILogger, string?, Exception?> _invalidBackchannelLoginId = LoggerMessage.Define<string?>(
Expand All @@ -22,7 +22,7 @@ public static void InvalidId(this ILogger logger, string? id)

public static void InvalidBackchannelLoginId(this ILogger logger, string? id)
{
_invalidBackchannelLoginId(logger, id, null);
_invalidBackchannelLoginId(logger, id?.ReplaceLineEndings(string.Empty), null);
}

private static Action<ILogger, IEnumerable<string>, Exception?> _externalClaims = LoggerMessage.Define<IEnumerable<string>>(
Expand All @@ -35,24 +35,24 @@ public static void ExternalClaims(this ILogger logger, IEnumerable<string> claim
_externalClaims(logger, claims, null);
}

private static Action<ILogger, string, Exception?> _noMatchingBackchannelLoginRequest = LoggerMessage.Define<string>(
private static Action<ILogger, string?, Exception?> _noMatchingBackchannelLoginRequest = LoggerMessage.Define<string?>(
LogLevel.Error,
EventIds.NoMatchingBackchannelLoginRequest,
"No backchannel login request matching id: {Id}");

public static void NoMatchingBackchannelLoginRequest(this ILogger logger, string id)
public static void NoMatchingBackchannelLoginRequest(this ILogger logger, string? id)
{
_noMatchingBackchannelLoginRequest(logger, id, null);
_noMatchingBackchannelLoginRequest(logger, id?.ReplaceLineEndings(string.Empty), null);
}

private static Action<ILogger, string, Exception?> _noConsentMatchingRequest = LoggerMessage.Define<string>(
private static Action<ILogger, string?, Exception?> _noConsentMatchingRequest = LoggerMessage.Define<string?>(
LogLevel.Error,
EventIds.NoConsentMatchingRequest,
"No consent request matching request: {ReturnUrl}");

public static void NoConsentMatchingRequest(this ILogger logger, string returnUrl)
public static void NoConsentMatchingRequest(this ILogger logger, string? returnUrl)
{
_noConsentMatchingRequest(logger, returnUrl, null);
_noConsentMatchingRequest(logger, returnUrl?.ReplaceLineEndings(string.Empty), null);
}


Expand Down
14 changes: 7 additions & 7 deletions BFF/v4/MultiFrontendSSO/MultiFrontendSSO.IdentityServer/Pages/Log.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,26 +22,26 @@ internal static class Log
EventIds.ExternalClaims,
"External claims: {Claims}");

private static Action<ILogger, string, Exception?> _noMatchingBackchannelLoginRequest =
LoggerMessage.Define<string>(
private static Action<ILogger, string?, Exception?> _noMatchingBackchannelLoginRequest =
LoggerMessage.Define<string?>(
LogLevel.Error,
EventIds.NoMatchingBackchannelLoginRequest,
"No backchannel login request matching id: {Id}");

private static Action<ILogger, string, Exception?> _noConsentMatchingRequest = LoggerMessage.Define<string>(
private static Action<ILogger, string?, Exception?> _noConsentMatchingRequest = LoggerMessage.Define<string?>(
LogLevel.Error,
EventIds.NoConsentMatchingRequest,
"No consent request matching request: {ReturnUrl}");

public static void InvalidId(this ILogger logger, string? id) => _invalidId(logger, id, null);
public static void InvalidId(this ILogger logger, string? id) => _invalidId(logger, id?.ReplaceLineEndings(string.Empty), null);

public static void InvalidBackchannelLoginId(this ILogger logger, string? id) => _invalidBackchannelLoginId(logger, id, null);
public static void InvalidBackchannelLoginId(this ILogger logger, string? id) => _invalidBackchannelLoginId(logger, id?.ReplaceLineEndings(string.Empty), null);

public static void ExternalClaims(this ILogger logger, IEnumerable<string> claims) => _externalClaims(logger, claims, null);

public static void NoMatchingBackchannelLoginRequest(this ILogger logger, string id) => _noMatchingBackchannelLoginRequest(logger, id, null);
public static void NoMatchingBackchannelLoginRequest(this ILogger logger, string? id) => _noMatchingBackchannelLoginRequest(logger, id?.ReplaceLineEndings(string.Empty), null);

public static void NoConsentMatchingRequest(this ILogger logger, string returnUrl) => _noConsentMatchingRequest(logger, returnUrl, null);
public static void NoConsentMatchingRequest(this ILogger logger, string? returnUrl) => _noConsentMatchingRequest(logger, returnUrl?.ReplaceLineEndings(string.Empty), null);
}

internal static class EventIds
Expand Down
4 changes: 2 additions & 2 deletions BFF/v4/TokenExchange/TokenExchange.IdentityServer/Pages/Ciba/Consent.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ public async Task<IActionResult> OnPost()
var request = await _interaction.GetLoginRequestByInternalIdAsync(Input.Id, HttpContext.RequestAborted);
if (request == null || request.Subject.GetSubjectId() != User.GetSubjectId())
{
_logger.LogError("Invalid id {id}", Input.Id);
_logger.LogError("Invalid id {id}", Input.Id?.ReplaceLineEndings(string.Empty));
return RedirectToPage("/Home/Error/Index");
}

Expand Down Expand Up @@ -125,7 +125,7 @@ private async Task<ViewModel> BuildViewModelAsync(string id, InputModel model =
}
else
{
_logger.LogError("No backchannel login request matching id: {id}", id);
_logger.LogError("No backchannel login request matching id: {id}", id?.ReplaceLineEndings(string.Empty));
}
return null;
}
Expand Down
2 changes: 1 addition & 1 deletion BFF/v4/TokenExchange/TokenExchange.IdentityServer/Pages/Ciba/Index.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ public async Task<IActionResult> OnGet(string id)
LoginRequest = await _backchannelAuthenticationInteraction.GetLoginRequestByInternalIdAsync(id, HttpContext.RequestAborted);
if (LoginRequest == null)
{
_logger.LogWarning("Invalid backchannel login id {id}", id);
_logger.LogWarning("Invalid backchannel login id {id}", id?.ReplaceLineEndings(string.Empty));
return RedirectToPage("/home/error/index");
}

Expand Down
2 changes: 1 addition & 1 deletion BFF/v4/TokenExchange/TokenExchange.IdentityServer/Pages/Consent/Index.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@ private async Task<ViewModel> BuildViewModelAsync(string returnUrl, InputModel m
}
else
{
_logger.LogError("No consent request matching request: {0}", returnUrl);
_logger.LogError("No consent request matching request: {returnUrl}", returnUrl?.ReplaceLineEndings(string.Empty));
}
return null;
}
Expand Down
2 changes: 1 addition & 1 deletion BFF/v4/docker/ContainerizedIdentityServer/Pages/Account/Logout/LoggedOut.cshtml.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ public LoggedOut(IIdentityServerInteractionService interactionService, ILogger<L

public async Task OnGet(string? logoutId)
{
_logger.LogInformation("LoggedOut page OnGet called with logoutId: {LogoutId}", logoutId);
_logger.LogInformation("LoggedOut page OnGet called with logoutId: {LogoutId}", logoutId?.ReplaceLineEndings(string.Empty));

// Log the value configured in LogoutOptions
_logger.LogInformation("LogoutOptions.AutomaticRedirectAfterSignOut value is: {AutoRedirect}", LogoutOptions.AutomaticRedirectAfterSignOut);
Expand Down
16 changes: 8 additions & 8 deletions BFF/v4/docker/ContainerizedIdentityServer/Pages/Log.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ internal static class Log

public static void InvalidId(this ILogger logger, string? id)
{
_invalidId(logger, id, null);
_invalidId(logger, id?.ReplaceLineEndings(string.Empty), null);
}

private static readonly Action<ILogger, string?, Exception?> _invalidBackchannelLoginId = LoggerMessage.Define<string?>(
Expand All @@ -22,7 +22,7 @@ public static void InvalidId(this ILogger logger, string? id)

public static void InvalidBackchannelLoginId(this ILogger logger, string? id)
{
_invalidBackchannelLoginId(logger, id, null);
_invalidBackchannelLoginId(logger, id?.ReplaceLineEndings(string.Empty), null);
}

private static Action<ILogger, IEnumerable<string>, Exception?> _externalClaims = LoggerMessage.Define<IEnumerable<string>>(
Expand All @@ -35,24 +35,24 @@ public static void ExternalClaims(this ILogger logger, IEnumerable<string> claim
_externalClaims(logger, claims, null);
}

private static Action<ILogger, string, Exception?> _noMatchingBackchannelLoginRequest = LoggerMessage.Define<string>(
private static Action<ILogger, string?, Exception?> _noMatchingBackchannelLoginRequest = LoggerMessage.Define<string?>(
LogLevel.Error,
EventIds.NoMatchingBackchannelLoginRequest,
"No backchannel login request matching id: {Id}");

public static void NoMatchingBackchannelLoginRequest(this ILogger logger, string id)
public static void NoMatchingBackchannelLoginRequest(this ILogger logger, string? id)
{
_noMatchingBackchannelLoginRequest(logger, id, null);
_noMatchingBackchannelLoginRequest(logger, id?.ReplaceLineEndings(string.Empty), null);
}

private static Action<ILogger, string, Exception?> _noConsentMatchingRequest = LoggerMessage.Define<string>(
private static Action<ILogger, string?, Exception?> _noConsentMatchingRequest = LoggerMessage.Define<string?>(
LogLevel.Error,
EventIds.NoConsentMatchingRequest,
"No consent request matching request: {ReturnUrl}");

public static void NoConsentMatchingRequest(this ILogger logger, string returnUrl)
public static void NoConsentMatchingRequest(this ILogger logger, string? returnUrl)
{
_noConsentMatchingRequest(logger, returnUrl, null);
_noConsentMatchingRequest(logger, returnUrl?.ReplaceLineEndings(string.Empty), null);
}


Expand Down
18 changes: 9 additions & 9 deletions IdentityServer/v7/AspNetIdentityPasskeys/IdentityServerAspNetIdentityPasskeys/Pages/Log.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ internal static class Log
EventIds.InvalidId,
"Invalid id {Id}");

public static void InvalidId(this ILogger logger, string? id) => _invalidId(logger, id, null);
public static void InvalidId(this ILogger logger, string? id) => _invalidId(logger, id?.ReplaceLineEndings(string.Empty), null);

private static readonly Action<ILogger, string?, Exception?> _invalidBackchannelLoginId =
LoggerMessage.Define<string?>(
Expand All @@ -19,7 +19,7 @@ internal static class Log
"Invalid backchannel login id {Id}");

public static void InvalidBackchannelLoginId(this ILogger logger, string? id) =>
_invalidBackchannelLoginId(logger, id, null);
_invalidBackchannelLoginId(logger, id?.ReplaceLineEndings(string.Empty), null);

private static Action<ILogger, IEnumerable<string>, Exception?> _externalClaims =
LoggerMessage.Define<IEnumerable<string>>(
Expand All @@ -30,22 +30,22 @@ public static void InvalidBackchannelLoginId(this ILogger logger, string? id) =>
public static void ExternalClaims(this ILogger logger, IEnumerable<string> claims) =>
_externalClaims(logger, claims, null);

private static Action<ILogger, string, Exception?> _noMatchingBackchannelLoginRequest =
LoggerMessage.Define<string>(
private static Action<ILogger, string?, Exception?> _noMatchingBackchannelLoginRequest =
LoggerMessage.Define<string?>(
LogLevel.Error,
EventIds.NoMatchingBackchannelLoginRequest,
"No backchannel login request matching id: {Id}");

public static void NoMatchingBackchannelLoginRequest(this ILogger logger, string id) =>
_noMatchingBackchannelLoginRequest(logger, id, null);
public static void NoMatchingBackchannelLoginRequest(this ILogger logger, string? id) =>
_noMatchingBackchannelLoginRequest(logger, id?.ReplaceLineEndings(string.Empty), null);

private static Action<ILogger, string, Exception?> _noConsentMatchingRequest = LoggerMessage.Define<string>(
private static Action<ILogger, string?, Exception?> _noConsentMatchingRequest = LoggerMessage.Define<string?>(
LogLevel.Error,
EventIds.NoConsentMatchingRequest,
"No consent request matching request: {ReturnUrl}");

public static void NoConsentMatchingRequest(this ILogger logger, string returnUrl) =>
_noConsentMatchingRequest(logger, returnUrl, null);
public static void NoConsentMatchingRequest(this ILogger logger, string? returnUrl) =>
_noConsentMatchingRequest(logger, returnUrl?.ReplaceLineEndings(string.Empty), null);
}

internal static class EventIds
Expand Down
16 changes: 8 additions & 8 deletions IdentityServer/v7/Configuration/IdentityServerHost/Pages/Log.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ internal static class Log

public static void InvalidId(this ILogger logger, string? id)
{
_invalidId(logger, id, null);
_invalidId(logger, id?.ReplaceLineEndings(string.Empty), null);
}

private static readonly Action<ILogger, string?, Exception?> _invalidBackchannelLoginId = LoggerMessage.Define<string?>(
Expand All @@ -22,7 +22,7 @@ public static void InvalidId(this ILogger logger, string? id)

public static void InvalidBackchannelLoginId(this ILogger logger, string? id)
{
_invalidBackchannelLoginId(logger, id, null);
_invalidBackchannelLoginId(logger, id?.ReplaceLineEndings(string.Empty), null);
}

private static Action<ILogger, IEnumerable<string>, Exception?> _externalClaims = LoggerMessage.Define<IEnumerable<string>>(
Expand All @@ -35,24 +35,24 @@ public static void ExternalClaims(this ILogger logger, IEnumerable<string> claim
_externalClaims(logger, claims, null);
}

private static Action<ILogger, string, Exception?> _noMatchingBackchannelLoginRequest = LoggerMessage.Define<string>(
private static Action<ILogger, string?, Exception?> _noMatchingBackchannelLoginRequest = LoggerMessage.Define<string?>(
LogLevel.Error,
EventIds.NoMatchingBackchannelLoginRequest,
"No backchannel login request matching id: {Id}");

public static void NoMatchingBackchannelLoginRequest(this ILogger logger, string id)
public static void NoMatchingBackchannelLoginRequest(this ILogger logger, string? id)
{
_noMatchingBackchannelLoginRequest(logger, id, null);
_noMatchingBackchannelLoginRequest(logger, id?.ReplaceLineEndings(string.Empty), null);
}

private static Action<ILogger, string, Exception?> _noConsentMatchingRequest = LoggerMessage.Define<string>(
private static Action<ILogger, string?, Exception?> _noConsentMatchingRequest = LoggerMessage.Define<string?>(
LogLevel.Error,
EventIds.NoConsentMatchingRequest,
"No consent request matching request: {ReturnUrl}");

public static void NoConsentMatchingRequest(this ILogger logger, string returnUrl)
public static void NoConsentMatchingRequest(this ILogger logger, string? returnUrl)
{
_noConsentMatchingRequest(logger, returnUrl, null);
_noConsentMatchingRequest(logger, returnUrl?.ReplaceLineEndings(string.Empty), null);
}


Expand Down
Loading
Loading