richard/wiki - wiki - Gitea: RS Source Repository

2198 Commits

3 Branches

122 Tags

62 MiB

Tree: 628d57d279

Commit Graph

Author	SHA1	Message	Date
Kyle Gehmlich	545ba4ec95	fix: remove duplicate query parameters on HTTPS redirect (#6460 ) HTTPS redirection rebuilds the full URL using req.originalUrl, which includes query parameters (see https://expressjs.com/en/api.html#req.originalUrl). Prior to this patch, appending the stringified query params to req.originalUrl resulted in duplicate parameters, e.g. wiki.js/callback?session=123&code=abc?session=123&code=abc which caused errors when being redirected from an insecure (http://) callback URL to a secure version when using OIDC (e.g. with keycloak). This issue is probably rare, but in cases where HTTPS redirection is enabled and a user tries to hit an insecure URL with query parameters, it could cause problems.	2 years ago
NGPixel	ae53484abd	feat: admin ssl - renew cert + toggle redirection btn	5 years ago
NGPixel	c6933a2d20	feat: let's encrypt	5 years ago

Author

SHA1

Message

Date

Kyle Gehmlich

545ba4ec95

fix: remove duplicate query parameters on HTTPS redirect (#6460 )

HTTPS redirection rebuilds the full URL using req.originalUrl, which
includes query parameters (see
https://expressjs.com/en/api.html#req.originalUrl). Prior to this patch,
appending the stringified query params to req.originalUrl resulted in
duplicate parameters, e.g.
wiki.js/callback?session=123&code=abc?session=123&code=abc
which caused errors when being redirected from an insecure (http://)
callback URL to a secure version when using OIDC (e.g. with keycloak).

This issue is probably rare, but in cases where HTTPS redirection is
enabled and a user tries to hit an insecure URL with query parameters,
it could cause problems.

2 years ago

NGPixel

ae53484abd

feat: admin ssl - renew cert + toggle redirection btn

5 years ago

NGPixel

c6933a2d20

feat: let's encrypt

5 years ago

2 Commits (628d57d2794b0a0bbb3f6beca8241a28afcdc9f9)