Disallow empty (undeletable) redirect URIs

datasektionen · Aug 19, 2024 · 43bca8b · 43bca8b
1 parent 2c3a194
commit 43bca8b
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 3 deletions.
diff --git a/services/admin/handlers.go b/services/admin/handlers.go
@@ -426,6 +426,9 @@ func (s *service) addRedirectURI(w http.ResponseWriter, r *http.Request) httputi
 		return httputil.BadRequest("Invalid id")
 	}
 	newURI := r.FormValue("redirect-uri")
+	if newURI == "" {
+		return httputil.BadRequest("Missing uri")
+	}
 
 	client, err := s.db.GetClient(r.Context(), id)
 	if err == pgx.ErrNoRows {

diff --git a/services/admin/oidc_clients.templ b/services/admin/oidc_clients.templ
@@ -51,6 +51,7 @@ templ oidcClient(client database.OidcClient, secret []byte) {
 					<input
 						type="text"
 						name="redirect-uri"
+						required
 						class={ input }
 						autofocus
 					/>

diff --git a/services/admin/oidc_clients_templ.go b/services/admin/oidc_clients_templ.go