• Stan Hu's avatar
    Alias GitHub and BitBucket OAuth2 callback URLs · 88f2e961
    Stan Hu authored
    To prevent an OAuth2 covert redirect vulnerability, this commit adds and
    uses an alias for the GitHub and BitBucket OAuth2 callback URLs to the
    following paths:
    
    GitHub: /users/auth/-/import/github
    Bitbucket: /users/auth/-/import/bitbucket
    
    This allows admins to put a more restrictive callback URL in the OAuth2
    configuration settings. Instead of https://example.com, admins can now use:
    
    https://example.com/users/auth
    
    It's possible but not trivial to change Devise and OmniAuth to use a
    different prefix for callback URLs instead of /users/auth. For now,
    aliasing the import URLs under the /users/auth namespace should suffice.
    
    Closes gitlab-org/gitlab-ce#56663
    88f2e961
Name
Last commit
Last update
..
img Loading commit data...
README.md Loading commit data...
akismet.md Loading commit data...
auth0.md Loading commit data...
azure.md Loading commit data...
bitbucket.md Loading commit data...
cas.md Loading commit data...
chat_commands.md Loading commit data...
crowd.md Loading commit data...
external-issue-tracker.md Loading commit data...
facebook.md Loading commit data...
github.md Loading commit data...
gitlab.md Loading commit data...
gmail_action_buttons_for_gitlab.md Loading commit data...
google.md Loading commit data...
jira.md Loading commit data...
ldap.md Loading commit data...
oauth2_generic.md Loading commit data...
oauth_provider.md Loading commit data...
omniauth.md Loading commit data...
openid_connect_provider.md Loading commit data...
recaptcha.md Loading commit data...
saml.md Loading commit data...
shibboleth.md Loading commit data...
slack.md Loading commit data...
slash_commands.md Loading commit data...
trello_power_up.md Loading commit data...
twitter.md Loading commit data...