Issue ouverte · Issue #1010 Authorization endpoint accepts a repeated redirect_uri or a client_id with dot segments · @rmdes
Two malformed authorization requests reach the consent screen instead of being refused (packages/endpoint-auth/lib/controllers/authorization.js):
redirect_uri. Express parses redirect_uri=a&redirect_uri=b as an array, the URL check passes it, and String(redirect_uri) joins it with a comma. The consent screen then says it will redirect to a,b.client_id with a . or .. path segment, which the spec rules out for client identifiers. Only URL.canParse is checked, and parsing resolves the segments away.Found with the IndieAuth test suite (S213, S219): https://dev.indieauth.rocks/implementations/2, see #967.