Fix/validate redirect uri (#502)

* fix: validate redirect_uri against AllowedOrigins to prevent open redirect token theft

Six endpoints accepted user-controlled redirect_uri without validating
against AllowedOrigins, allowing attackers to steal tokens by redirecting
to malicious URLs. Added validators.IsValidOrigin() checks to:

- ForgotPassword (GraphQL mutation)
- MagicLinkLogin (GraphQL mutation)
- SignUp (GraphQL mutation)
- InviteMembers (GraphQL mutation)
- OAuthLoginHandler (HTTP handler)
- VerifyEmailHandler (HTTP handler, both query param and JWT claim fallback)

* test: add redirect_uri validation tests for open-redirect prevention

Tests verify that ForgotPassword, MagicLinkLogin, SignUp, and
InviteMembers reject attacker-controlled redirect_uri values not
matching AllowedOrigins, and accept valid ones.

* test: fix redirect_uri validation tests to use correct AllowedOrigins format

IsValidOrigin compares hostname:port (without protocol), so
AllowedOrigins must be specified without the http:// prefix.
Also use SQLite to allow tests to run without Docker/Postgres.

* fix: rewrite IsValidOrigin to use net/url and normalize origins correctly

The previous implementation compared allowed origins (e.g.
"https://example.com") as raw regex against "hostname:port", so
protocols in AllowedOrigins caused matches to always fail. Now both
input URL and allowed origins are normalized via net/url.Parse to
strip protocol/path before comparison. Also anchors the regex with
^...$ to prevent partial matches (e.g. "example.com" matching
"notexample.com").

Adds comprehensive unit tests covering: exact domains, custom ports,
standard ports (80/443), bare domains without protocol, subdomains,
deep subdomains, wildcard subdomains, wildcard with port, multiple
origins, attacker URLs, www variants, and live domain scenarios.

* fix: update InviteMembers test to use allowed origin for redirect_uri

The test was using "https://authorizer.dev/" which is not in
AllowedOrigins, so it now correctly gets rejected by the new
redirect_uri validation. Updated to use "http://localhost:3000/"
which matches the test config's AllowedOrigins.

Author: lakhansamani

ROADMAP_V2.md

@@ -16,6 +16,7 @@ import (
 	"github.com/authorizerdev/authorizer/internal/storage/schemas"
 	"github.com/authorizerdev/authorizer/internal/token"
 	"github.com/authorizerdev/authorizer/internal/utils"
+	"github.com/authorizerdev/authorizer/internal/validators"
 )
 
 // ForgotPassword is a  for forgot password mutation
@@ -75,6 +76,10 @@ func (g *graphqlProvider) ForgotPassword(ctx context.Context, params *model.Forg
 		// give higher preference to params redirect uri
 		if strings.TrimSpace(refs.StringValue(params.RedirectURI)) != "" {
 			redirectURI = refs.StringValue(params.RedirectURI)
+			if !validators.IsValidOrigin(redirectURI, g.Config.AllowedOrigins) {
+				log.Debug().Msg("Invalid redirect URI")
+				return nil, fmt.Errorf("invalid redirect URI")
+			}
 		} else {
 			redirectURI = g.Config.ResetPasswordURL
 			if redirectURI == "" {

internal/graphql/forgot_password.go

@@ -89,6 +89,10 @@ func (g *graphqlProvider) InviteMembers(ctx context.Context, params *model.Invit
 		redirectURL := appURL
 		if params.RedirectURI != nil {
 			redirectURL = *params.RedirectURI
+			if !validators.IsValidOrigin(redirectURL, g.Config.AllowedOrigins) {
+				log.Debug().Msg("Invalid redirect URI")
+				return nil, fmt.Errorf("invalid redirect URI")
+			}
 		}
 
 		_, nonceHash, err := utils.GenerateNonce()

internal/graphql/invite_members.go

@@ -149,6 +149,10 @@ func (g *graphqlProvider) MagicLinkLogin(ctx context.Context, params *model.Magi
 		redirectURL := parsers.GetAppURL(gc)
 		if params.RedirectURI != nil {
 			redirectURL = *params.RedirectURI
+			if !validators.IsValidOrigin(redirectURL, g.Config.AllowedOrigins) {
+				log.Debug().Msg("Invalid redirect URI")
+				return nil, fmt.Errorf("invalid redirect URI")
+			}
 		}
 
 		if strings.Contains(redirectURL, "?") {

internal/graphql/magic_link_login.go

@@ -210,6 +210,10 @@ func (g *graphqlProvider) SignUp(ctx context.Context, params *model.SignUpReques
 		redirectURL := parsers.GetAppURL(gc)
 		if params.RedirectURI != nil {
 			redirectURL = *params.RedirectURI
+			if !validators.IsValidOrigin(redirectURL, g.Config.AllowedOrigins) {
+				log.Debug().Msg("Invalid redirect URI")
+				return nil, fmt.Errorf("invalid redirect URI")
+			}
 		}
 		verificationToken, err := g.TokenProvider.CreateVerificationToken(&token.AuthTokenConfig{
 			Nonce:       nonceHash,

internal/graphql/signup.go

@@ -31,6 +31,14 @@ func (h *httpProvider) OAuthLoginHandler() gin.HandlerFunc {
 			return
 		}
 
+		if !validators.IsValidOrigin(redirectURI, h.Config.AllowedOrigins) {
+			log.Debug().Msg("Invalid redirect URI")
+			c.JSON(400, gin.H{
+				"error": "invalid redirect uri",
+			})
+			return
+		}
+
 		if state == "" {
 			log.Debug().Msg("state is missing, creating new state")
 			state = uuid.New().String()

internal/http_handlers/oauth_login.go

@@ -25,6 +25,11 @@ func (h *httpProvider) VerifyEmailHandler() gin.HandlerFunc {
 	log := h.Log.With().Str("func", "VerifyEmailHandler").Logger()
 	return func(c *gin.Context) {
 		redirectURL := strings.TrimSpace(c.Query("redirect_uri"))
+		if redirectURL != "" && !validators.IsValidOrigin(redirectURL, h.Config.AllowedOrigins) {
+			log.Debug().Msg("Invalid redirect URI")
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid redirect uri"})
+			return
+		}
 		errorRes := gin.H{
 			"error": "token is required",
 		}
@@ -194,6 +199,11 @@ func (h *httpProvider) VerifyEmailHandler() gin.HandlerFunc {
 		if redirectURL == "" {
 			redirectURL = claim["redirect_uri"].(string)
 		}
+		if !validators.IsValidOrigin(redirectURL, h.Config.AllowedOrigins) {
+			log.Debug().Msg("Invalid redirect URI in token claim")
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid redirect uri"})
+			return
+		}
 
 		if strings.Contains(redirectURL, "?") {
 			redirectURL = redirectURL + "&" + params

internal/http_handlers/verify_email.go

@@ -22,7 +22,7 @@ func TestInviteMembersUser(t *testing.T) {
 	email := "invite_user_test_" + uuid.New().String() + "@authorizer.dev"
 	emailTo := "test_user_invitation_" + uuid.New().String() + "@authorizer.dev"
 	password := "Password@123"
-	url := "https://authorizer.dev/"
+	url := "http://localhost:3000/"
 	// Signup the user
 	signupReq := &model.SignUpRequest{
 		Email:           &email,

internal/integration_tests/invite_members_test.go

@@ -0,0 +1,169 @@
+package integration_tests
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/authorizerdev/authorizer/internal/constants"
+	"github.com/authorizerdev/authorizer/internal/crypto"
+	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/refs"
+)
+
+// TestRedirectURIValidation verifies that all endpoints accepting redirect_uri
+// validate it against AllowedOrigins to prevent open-redirect token theft.
+func TestRedirectURIValidation(t *testing.T) {
+	cfg := getTestConfig()
+	// Use SQLite so tests can run without Postgres/Docker
+	cfg.DatabaseType = constants.DbTypeSqlite
+	cfg.DatabaseURL = "authorizer_redirect_test.db"
+	cfg.AllowedOrigins = []string{"http://localhost:3000"}
+	cfg.EnableMagicLinkLogin = true
+	cfg.EnableEmailVerification = true
+	cfg.IsEmailServiceEnabled = true
+	cfg.IsSMSServiceEnabled = true
+	cfg.SMTPHost = "localhost"
+	cfg.SMTPPort = 1025
+	cfg.SMTPSenderEmail = "test@authorizer.dev"
+	cfg.SMTPSenderName = "Test"
+	cfg.SMTPLocalName = "Test"
+	cfg.SMTPSkipTLSVerification = true
+
+	ts := initTestSetup(t, cfg)
+	_, ctx := createContext(ts)
+
+	attackerURL := "https://attacker.com/steal"
+	validURL := "http://localhost:3000/callback"
+
+	t.Run("ForgotPassword should reject invalid redirect_uri", func(t *testing.T) {
+		// First create a user
+		email := "fp_redirect_test_" + uuid.New().String() + "@authorizer.dev"
+		password := "Password@123"
+		signupRes, err := ts.GraphQLProvider.SignUp(ctx, &model.SignUpRequest{
+			Email:           &email,
+			Password:        password,
+			ConfirmPassword: password,
+		})
+		require.NoError(t, err)
+		require.NotNil(t, signupRes)
+
+		// Attacker-controlled redirect_uri should be rejected
+		res, err := ts.GraphQLProvider.ForgotPassword(ctx, &model.ForgotPasswordRequest{
+			Email:       refs.NewStringRef(email),
+			RedirectURI: refs.NewStringRef(attackerURL),
+		})
+		assert.Error(t, err)
+		assert.Nil(t, res)
+		assert.Contains(t, err.Error(), "invalid redirect URI")
+	})
+
+	t.Run("ForgotPassword should accept valid redirect_uri", func(t *testing.T) {
+		email := "fp_valid_redirect_" + uuid.New().String() + "@authorizer.dev"
+		password := "Password@123"
+		signupRes, err := ts.GraphQLProvider.SignUp(ctx, &model.SignUpRequest{
+			Email:           &email,
+			Password:        password,
+			ConfirmPassword: password,
+		})
+		require.NoError(t, err)
+		require.NotNil(t, signupRes)
+
+		res, err := ts.GraphQLProvider.ForgotPassword(ctx, &model.ForgotPasswordRequest{
+			Email:       refs.NewStringRef(email),
+			RedirectURI: refs.NewStringRef(validURL),
+		})
+		assert.NoError(t, err)
+		assert.NotNil(t, res)
+	})
+
+	t.Run("MagicLinkLogin should reject invalid redirect_uri", func(t *testing.T) {
+		email := "ml_redirect_test_" + uuid.New().String() + "@authorizer.dev"
+		res, err := ts.GraphQLProvider.MagicLinkLogin(ctx, &model.MagicLinkLoginRequest{
+			Email:       email,
+			RedirectURI: &attackerURL,
+		})
+		assert.Error(t, err)
+		assert.Nil(t, res)
+		assert.Contains(t, err.Error(), "invalid redirect URI")
+	})
+
+	t.Run("MagicLinkLogin should accept valid redirect_uri", func(t *testing.T) {
+		email := "ml_valid_redirect_" + uuid.New().String() + "@authorizer.dev"
+		res, err := ts.GraphQLProvider.MagicLinkLogin(ctx, &model.MagicLinkLoginRequest{
+			Email:       email,
+			RedirectURI: &validURL,
+		})
+		assert.NoError(t, err)
+		assert.NotNil(t, res)
+	})
+
+	t.Run("Signup should reject invalid redirect_uri", func(t *testing.T) {
+		email := "signup_redirect_test_" + uuid.New().String() + "@authorizer.dev"
+		password := "Password@123"
+		res, err := ts.GraphQLProvider.SignUp(ctx, &model.SignUpRequest{
+			Email:           &email,
+			Password:        password,
+			ConfirmPassword: password,
+			RedirectURI:     &attackerURL,
+		})
+		assert.Error(t, err)
+		assert.Nil(t, res)
+		assert.Contains(t, err.Error(), "invalid redirect URI")
+	})
+
+	t.Run("Signup should accept valid redirect_uri", func(t *testing.T) {
+		email := "signup_valid_redirect_" + uuid.New().String() + "@authorizer.dev"
+		password := "Password@123"
+		res, err := ts.GraphQLProvider.SignUp(ctx, &model.SignUpRequest{
+			Email:           &email,
+			Password:        password,
+			ConfirmPassword: password,
+			RedirectURI:     &validURL,
+		})
+		assert.NoError(t, err)
+		assert.NotNil(t, res)
+	})
+
+	t.Run("InviteMembers should reject invalid redirect_uri", func(t *testing.T) {
+		cfg.IsEmailServiceEnabled = true
+		cfg.EnableBasicAuthentication = true
+		cfg.EnableMagicLinkLogin = true
+
+		req, _ := createContext(ts)
+		h, err := crypto.EncryptPassword(cfg.AdminSecret)
+		require.NoError(t, err)
+		req.Header.Set("Cookie", fmt.Sprintf("%s=%s", constants.AdminCookieName, h))
+
+		emailTo := "invite_redirect_test_" + uuid.New().String() + "@authorizer.dev"
+		res, err := ts.GraphQLProvider.InviteMembers(ctx, &model.InviteMemberRequest{
+			Emails:      []string{emailTo},
+			RedirectURI: &attackerURL,
+		})
+		assert.Error(t, err)
+		assert.Nil(t, res)
+		assert.Contains(t, err.Error(), "invalid redirect URI")
+	})
+
+	t.Run("InviteMembers should accept valid redirect_uri", func(t *testing.T) {
+		cfg.IsEmailServiceEnabled = true
+		cfg.EnableBasicAuthentication = true
+		cfg.EnableMagicLinkLogin = true
+
+		req, _ := createContext(ts)
+		h, err := crypto.EncryptPassword(cfg.AdminSecret)
+		require.NoError(t, err)
+		req.Header.Set("Cookie", fmt.Sprintf("%s=%s", constants.AdminCookieName, h))
+
+		emailTo := "invite_valid_redirect_" + uuid.New().String() + "@authorizer.dev"
+		res, err := ts.GraphQLProvider.InviteMembers(ctx, &model.InviteMemberRequest{
+			Emails:      []string{emailTo},
+			RedirectURI: &validURL,
+		})
+		assert.NoError(t, err)
+		assert.NotNil(t, res)
+	})
+}

internal/integration_tests/redirect_uri_validation_test.go

@@ -1,14 +1,33 @@
 package validators
 
 import (
+	"net/url"
 	"regexp"
 	"strings"
-
-	"github.com/authorizerdev/authorizer/internal/parsers"
 )
 
+// normalizeOrigin extracts hostname:port from a URL or origin string.
+// Standard ports (80/443) and absent ports are omitted so that
+// "https://example.com" and "https://example.com:443" both normalise to "example.com".
+func normalizeOrigin(raw string) string {
+	raw = strings.TrimSpace(raw)
+	if !strings.HasPrefix(raw, "http://") && !strings.HasPrefix(raw, "https://") {
+		raw = "https://" + raw
+	}
+	u, err := url.Parse(raw)
+	if err != nil {
+		return raw
+	}
+	host := u.Hostname()
+	port := u.Port()
+	if port == "" || port == "443" || port == "80" {
+		return host
+	}
+	return host + ":" + port
+}
+
 // IsValidOrigin validates origin based on ALLOWED_ORIGINS
-func IsValidOrigin(url string, allowedOriginsConfig []string) bool {
+func IsValidOrigin(inputURL string, allowedOriginsConfig []string) bool {
 	allowedOrigins := allowedOriginsConfig
 	if len(allowedOrigins) == 0 {
 		allowedOrigins = []string{"*"}
@@ -17,31 +36,30 @@ func IsValidOrigin(url string, allowedOriginsConfig []string) bool {
 		return true
 	}
 
-	hasValidURL := false
-	hostName, port := parsers.GetHostParts(url)
-	currentOrigin := hostName + ":" + port
+	currentOrigin := normalizeOrigin(inputURL)
 
 	for _, origin := range allowedOrigins {
-		replacedString := origin
-		// if has regex whitelisted domains
+		// Normalize the allowed origin the same way as the input URL
+		pattern := normalizeOrigin(origin)
+
+		// if has wildcard domains, convert to regex
 		if strings.Contains(origin, "*") {
-			replacedString = strings.ReplaceAll(origin, ".", "\\.")
-			replacedString = strings.ReplaceAll(replacedString, "*", ".*")
+			pattern = strings.ReplaceAll(pattern, ".", "\\.")
+			pattern = strings.ReplaceAll(pattern, "*", ".*")
 
-			if strings.HasPrefix(replacedString, ".*") {
-				replacedString += "\\b"
+			if strings.HasPrefix(pattern, ".*") {
+				pattern += "\\b"
 			}
 
-			if strings.HasSuffix(replacedString, ".*") {
-				replacedString = "\\b" + replacedString
+			if strings.HasSuffix(pattern, ".*") {
+				pattern = "\\b" + pattern
 			}
 		}
 
-		if matched, _ := regexp.MatchString(replacedString, currentOrigin); matched {
-			hasValidURL = true
-			break
+		if matched, _ := regexp.MatchString("^"+pattern+"$", currentOrigin); matched {
+			return true
 		}
 	}
 
-	return hasValidURL
+	return false
 }