standard_id 0.20.0 → 0.20.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: faa6cfb238d38d71af682021ba3b6407cf06657c1b12e7ff29474dc97c753277
-  data.tar.gz: 365d86af12a4fef90b669f52114ae449d07facd5389089b438ae67174f75059e
+  metadata.gz: 664c61bf0dc0dbcf758fe4d114fad3776d0327777b64dde60f6d9d9f11db14cc
+  data.tar.gz: c87f620480f13c64051a0d915b37e2fd295f224f0a41fe0c4820bb8131321c70
 SHA512:
-  metadata.gz: 4ffc829b81cb6315954c5f2b3632889a7afd3c7457c4971297698f04ec9f43682b7eb715f711e2b28ea3c40d33f51519fc7339cd8d0f4996a7adad413677e880
-  data.tar.gz: 6247cc6fd0deeee072d90711ae1443d01d42bb585a58330358d9596fae8e665e14af4c274a478f7bc43b4e47adc2aca05d4f2c6ab7a7dc1c4caa846f751ab917
+  metadata.gz: 4531519bbd926a39fda0180809a305f1e7de319cb278d1b75b178616548b586d9b767db3eb9e58e661045bc513efbc6785b5a63fa858b91fd74a832170f96c50
+  data.tar.gz: b7625be363e4f848fdd7c61f51c287ed8153e2671b64e52e0acef48de4e0ff95668529e5099f7408d4713321406728c8a6d1225418bc4ba03444bd0c12916430

data/app/controllers/concerns/standard_id/lifecycle_hooks.rb

@@ -100,6 +100,12 @@ module StandardId
     #   - :profile_type [String, nil] first configured profile type for the scope (back-compat)
     #   - :profile_types [Array<String>, nil] all configured profile types for the scope
     #   - :after_sign_in_path [String, nil] default redirect path for the scope
+    #   - :redirect_uri [String, nil] caller-supplied destination (from the form
+    #     param for password/signup, from the OAuth state cookie for social).
+    #     Hooks that always return a default path should return nil when this is
+    #     present so the originator's URL wins — otherwise upstream OAuth/SSO
+    #     flows that send users to /login?redirect_uri=... will land on the
+    #     hook's default page instead of completing the handshake.
     # @return [String, nil] redirect path override, or nil for default
     # @raise [StandardId::AuthenticationDenied] to reject the sign-in
     def invoke_after_sign_in(account, context)
@@ -118,6 +124,12 @@ module StandardId
         return result if result.present?
       end
 
+      # When the caller supplied a :redirect_uri and the hook returned nil, treat that
+      # as the documented "defer to originator" signal — do NOT shadow it with the
+      # scope's after_sign_in_path (which would silently break OAuth/SSO handshakes
+      # for any host that configures a scope default).
+      return nil if context[:redirect_uri].present?
+
       # When no hook override, use the scope's after_sign_in_path if present
       scope_config&.after_sign_in_path
     end

data/app/controllers/standard_id/web/auth/callback/providers_controller.rb

@@ -26,6 +26,7 @@ module StandardId
 
             begin
               extract_state_and_nonce => { state_data:, nonce: }
+              caller_redirect_uri = state_data&.dig("redirect_uri").presence
               redirect_uri = callback_url_for
               provider_response = get_user_info_from_provider(redirect_uri:, nonce:)
               social_info = provider_response[:user_info]
@@ -52,10 +53,19 @@ module StandardId
                 original_request_params: state_data
               )
 
-              context = { mechanism: "social", provider: provider_name }
+              context = {
+                mechanism: "social",
+                provider: provider_name,
+                redirect_uri: caller_redirect_uri
+              }
               redirect_override = invoke_after_sign_in(account, context)
 
-              destination = redirect_override || state_data["redirect_uri"]
+              # When the hook defers (returns nil), the originator-supplied URL becomes the
+              # destination. Validate it before redirect_to — without this, an attacker who
+              # tricks a victim into clicking /login?connection=google&redirect_uri=<evil>
+              # can steer the post-auth landing page. redirect_override is host-internal so
+              # we trust it; only the fallthrough needs validation.
+              destination = redirect_override || (safe_destination?(caller_redirect_uri) ? caller_redirect_uri : safe_post_signin_default)
               redirect_options = { notice: "Successfully signed in with #{provider_name.humanize}" }
               redirect_options[:allow_other_host] = true if allow_other_host_redirect?(destination)
               redirect_to destination, redirect_options
@@ -124,7 +134,17 @@ module StandardId
                             "Authentication failed"
             end
 
-            redirect_to StandardId::WebEngine.routes.url_helpers.login_path, alert: error_message
+            # Preserve redirect_uri across the bounce-back-to-/login so the user can retry
+            # the OAuth handshake and complete it back to the originator. Symmetric with
+            # the SocialLinkError / OAuthError rescue paths above.
+            redirect_uri = begin
+              extract_state_and_nonce => { state_data: }
+              state_data&.dig("redirect_uri").presence
+            rescue StandardId::InvalidRequestError
+              nil
+            end
+
+            redirect_to StandardId::WebEngine.routes.url_helpers.login_path(redirect_uri: redirect_uri), alert: error_message
           end
 
           def mobile_relay_params

data/app/controllers/standard_id/web/base_controller.rb

@@ -14,6 +14,51 @@ module StandardId
 
       before_action -> { Current.scope = :web if defined?(::Current) }
       before_action :require_browser_session!
+
+      private
+
+      # Read a top-level query/form param expected to be a scalar String, returning
+      # nil for absent/blank values OR if Rails parsed it as an Array/Hash (e.g. from
+      # `?redirect_uri[]=a&redirect_uri[]=b`). Without this guard, `redirect_to` is
+      # called with a non-String and raises ArgumentError → 500 for any caller that
+      # sends a malformed redirect_uri.
+      def string_param(key)
+        value = params[key]
+        value.is_a?(String) ? value.presence : nil
+      end
+
+      # Whether `destination` is safe to redirect a signed-in user to.
+      # - Same-origin paths ("/foo") pass; protocol-relative ("//evil") does not.
+      # - Same-origin absolute URLs ("https://this-host/...") pass — `store_location_for_redirect`
+      #   stashes `request.url` in session, so callers wrapping `after_authentication_url`
+      #   need same-origin URLs accepted.
+      # - Cross-host URLs pass only when the host has explicitly allow-listed the prefix
+      #   via `StandardId.config.allowed_redirect_url_prefixes`.
+      # - Anything else (blank, absolute URL not in the allow-list, protocol-relative,
+      #   opaque scheme) is rejected; callers should fall back to `safe_post_signin_default`.
+      def safe_destination?(destination)
+        return false if destination.blank?
+        return true if destination.start_with?("/") && !destination.start_with?("//")
+        return true if same_origin_url?(destination)
+
+        Array(StandardId.config.allowed_redirect_url_prefixes).any? do |entry|
+          case entry
+          when Regexp then entry.match?(destination)
+          else destination.start_with?(entry.to_s)
+          end
+        end
+      end
+
+      def same_origin_url?(destination)
+        return false unless destination.start_with?("http://", "https://")
+        URI.parse(destination).origin == URI.parse(request.base_url).origin
+      rescue URI::Error, ArgumentError
+        false
+      end
+
+      def safe_post_signin_default
+        "/"
+      end
     end
   end
 end

data/app/controllers/standard_id/web/login_controller.rb

@@ -31,7 +31,7 @@ module StandardId
       before_action :redirect_if_social_login, only: [:create]
 
       def show
-        @redirect_uri = params[:redirect_uri] || after_authentication_url
+        @redirect_uri = string_param(:redirect_uri) || after_authentication_url
         @connection = params[:connection]
 
         render_with_inertia props: auth_page_props(passwordless_enabled: passwordless_enabled?)
@@ -59,9 +59,12 @@ module StandardId
         }
 
         if result
-          context = { mechanism: "password", provider: nil }
+          redirect_uri = string_param(:redirect_uri)
+          context = { mechanism: "password", provider: nil, redirect_uri: redirect_uri }
           redirect_override = invoke_after_sign_in(current_account, context)
-          destination = redirect_override || params[:redirect_uri] || after_authentication_url
+          fallback = after_authentication_url
+          fallback = safe_post_signin_default unless safe_destination?(fallback)
+          destination = redirect_override || (safe_destination?(redirect_uri) ? redirect_uri : nil) || fallback
           redirect_to destination, status: :see_other, notice: "Successfully signed in"
         else
           flash.now[:alert] = "Invalid email or password"
@@ -95,7 +98,11 @@ module StandardId
           expires_in: code_ttl.seconds
         )
         session[:standard_id_otp_payload] = signed_payload
-        session[:return_to_after_authenticating] = params[:redirect_uri] if params[:redirect_uri].present?
+        # Use string_param to reject Array/Hash-shaped values — login_verify_controller
+        # consumes this via after_authentication_url and passes it to redirect_to;
+        # storing a non-String here would crash that flow with ArgumentError.
+        redirect_uri = string_param(:redirect_uri)
+        session[:return_to_after_authenticating] = redirect_uri if redirect_uri
 
         redirect_to login_verify_path, status: :see_other
       end

data/app/controllers/standard_id/web/login_verify_controller.rb

@@ -60,12 +60,24 @@ module StandardId
           invoke_after_account_created(account, { mechanism: "passwordless", provider: nil })
         end
 
-        context = { mechanism: "passwordless", provider: nil }
+        # Peek (don't pop) session[:return_to_after_authenticating] — after_authentication_url
+        # consumes it below when redirect_override is nil, so deleting it here would lose the
+        # destination for hosts whose after_sign_in hook defers to the originator's redirect_uri.
+        context = {
+          mechanism: "passwordless",
+          provider: nil,
+          redirect_uri: session[:return_to_after_authenticating]
+        }
         redirect_override = invoke_after_sign_in(account, context)
 
         session.delete(:standard_id_otp_payload)
 
-        destination = redirect_override || after_authentication_url
+        # after_authentication_url returns whatever was stashed in
+        # session[:return_to_after_authenticating] — which could be an attacker-controlled
+        # URL set by handle_passwordless_login from params[:redirect_uri]. string_param
+        # blocks Array/Hash but not "https://evil.com/phish". Validate before redirect.
+        fallback = after_authentication_url
+        destination = redirect_override || (safe_destination?(fallback) ? fallback : safe_post_signin_default)
         redirect_to destination, status: :see_other, notice: "Successfully signed in"
       rescue StandardId::AuthenticationDenied => e
         session.delete(:standard_id_otp_payload)

data/app/controllers/standard_id/web/logout_controller.rb

@@ -14,13 +14,18 @@ module StandardId
 
       def create
         revoke_current_session!
-        redirect_to params[:redirect_uri] || root_path, notice: "Successfully signed out"
+        redirect_to logout_destination, notice: "Successfully signed out"
       end
 
       private
 
       def redirect_if_not_authenticated
-        redirect_to params[:redirect_uri] || root_path unless authenticated?
+        redirect_to logout_destination unless authenticated?
+      end
+
+      def logout_destination
+        redirect_uri = string_param(:redirect_uri)
+        safe_destination?(redirect_uri) ? redirect_uri : root_path
       end
     end
   end

data/app/controllers/standard_id/web/signup_controller.rb

@@ -15,7 +15,7 @@ module StandardId
       before_action :redirect_if_social_login, only: [:create]
 
       def show
-        @redirect_uri = params[:redirect_uri] || after_authentication_url
+        @redirect_uri = string_param(:redirect_uri) || after_authentication_url
         @connection = params[:connection] # For social login detection
 
         render_with_inertia props: auth_page_props
@@ -43,12 +43,15 @@ module StandardId
           session_manager.sign_in_account(form.account, scope_name: request.path_parameters[:scope])
           invoke_after_account_created(form.account, { mechanism: "signup", provider: nil })
 
-          context = { mechanism: "password", provider: nil }
+          redirect_uri = string_param(:redirect_uri)
+          context = { mechanism: "password", provider: nil, redirect_uri: redirect_uri }
           redirect_override = invoke_after_sign_in(form.account, context)
-          destination = redirect_override || params[:redirect_uri] || after_authentication_url
+          fallback = after_authentication_url
+          fallback = safe_post_signin_default unless safe_destination?(fallback)
+          destination = redirect_override || (safe_destination?(redirect_uri) ? redirect_uri : nil) || fallback
           redirect_to destination, notice: "Account created successfully"
         else
-          @redirect_uri = params[:redirect_uri] || after_authentication_url
+          @redirect_uri = string_param(:redirect_uri) || after_authentication_url
           @connection = params[:connection]
           flash.now[:alert] = form.errors.full_messages.join(", ")
           render_with_inertia action: :show, props: auth_page_props(errors: form.errors.to_hash), status: :unprocessable_content
@@ -79,7 +82,7 @@ module StandardId
 
       def encode_state
         Base64.urlsafe_encode64({
-          redirect_uri: params[:redirect_uri] || after_authentication_url,
+          redirect_uri: string_param(:redirect_uri) || after_authentication_url,
           timestamp: Time.current.to_i
         }.to_json)
       end

data/lib/standard_id/version.rb

@@ -1,3 +1,3 @@
 module StandardId
-  VERSION = "0.20.0"
+  VERSION = "0.20.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: standard_id
 version: !ruby/object:Gem::Version
-  version: 0.20.0
+  version: 0.20.1
 platform: ruby
 authors:
 - Jaryl Sim