Optimized URL handling

packages/react/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corbado/react",
-  "version": "3.7.0-alpha.0",
+  "version": "3.7.0-alpha.1",
   "description": "This package provides all the functionalities and UI components needed by developers when integration Corbado's Authentication management system in their react application",
   "author": "Abdullah Shahbaz <abdullah_ghani@live.com>",
   "homepage": "https://github.com/corbado/javascript#readme",
@@ -33,7 +33,7 @@
   "dependencies": {
     "@corbado/observe": "^0.0.1-next.4",
     "@corbado/shared-util": "^1.0.12",
-    "@corbado/web-core": "^3.7.0-alpha.0",
+    "@corbado/web-core": "^3.7.0-alpha.2",
     "i18next": "23.5.1",
     "i18next-browser-languagedetector": "7.1.0",
     "libphonenumber-js": "^1.10.59",

packages/web-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corbado/web-core",
-  "version": "3.7.0-alpha.1",
+  "version": "3.7.0-alpha.2",
   "description": "This package contains core functionalities which are exported by all the SDKs and UI packages of our JavaScript library",
   "author": "Abdullah Shahbaz <abdullah_ghani@live.com>",
   "homepage": "https://github.com/corbado/javascript#readme",

packages/web-core/src/models/authProcess.ts

@@ -51,14 +51,12 @@ export class AuthProcess {
 export class TempAuthProcess {
   readonly id: string;
   readonly projectId: string;
-  readonly frontendApiUrl: string;
   readonly expiresAt: number;
 
-  constructor(id: string, projectId: string, expiresAt: number, frontendApiUrl: string) {
+  constructor(id: string, projectId: string, expiresAt: number) {
     this.id = id;
     this.projectId = projectId;
     this.expiresAt = expiresAt;
-    this.frontendApiUrl = frontendApiUrl;
   }
 
   isValid(): boolean {

packages/web-core/src/models/emailVerifyFromUrl.ts

@@ -14,7 +14,6 @@ type EmailVerifyFromUrlData = {
     tempId: string;
     projectId: string;
     expires: number;
-    frontendApiUrl: string;
   };
 };
 
@@ -51,12 +50,7 @@ export class EmailVerifyFromUrl {
       authType = AuthType.Signup;
     }
 
-    const tempAuthProcess = new TempAuthProcess(
-      process.tempId,
-      process.projectId,
-      process.expires,
-      process.frontendApiUrl,
-    );
+    const tempAuthProcess = new TempAuthProcess(process.tempId, process.projectId, process.expires);
 
     return new EmailVerifyFromUrl(data, token, tempAuthProcess, authType);
   }

packages/web-core/src/services/ProcessService.ts

@@ -40,7 +40,12 @@ import type { TempAuthProcess } from '../models/authProcess';
 import { AuthProcess } from '../models/authProcess';
 import { EmailVerifyFromUrl } from '../models/emailVerifyFromUrl';
 import type { LastIdentifier } from '../models/lastIdentifier';
-import { CorbadoError, PasskeyChallengeCancelledError, skipPasskeyAppendAfterHybridKey } from '../utils';
+import {
+  CorbadoError,
+  isSafeRedirectUrl,
+  PasskeyChallengeCancelledError,
+  skipPasskeyAppendAfterHybridKey,
+} from '../utils';
 import { ClientStateService } from './ClientStateService';
 import { WebAuthnService } from './WebAuthnService';
 
@@ -154,6 +159,15 @@ export class ProcessService {
 
     try {
       const emailVerifyFromUrl = EmailVerifyFromUrl.fromURL(encodedProcess, token);
+
+      if (emailVerifyFromUrl.process.projectId !== this.#projectId) {
+        return Err(CorbadoError.invalidConfig());
+      }
+
+      if (!emailVerifyFromUrl.process.isValid()) {
+        return Err(CorbadoError.invalidConfig());
+      }
+
       this.#setApisV2ByTempProcess(emailVerifyFromUrl.process);
 
       return Ok(emailVerifyFromUrl);
@@ -250,9 +264,9 @@ export class ProcessService {
   }
 
   #setApisV2ByTempProcess(tempProcess: TempAuthProcess): void {
-    const frontendApiUrl = tempProcess.frontendApiUrl;
+    const frontendApiUrl = this.#getDefaultFrontendApiUrl();
     const config = new Configuration({
-      apiKey: tempProcess.projectId,
+      apiKey: this.#projectId,
       basePath: frontendApiUrl,
     });
 
@@ -524,6 +538,10 @@ export class ProcessService {
     }
 
     if (typed.socialData && typed.socialData.status === SocialDataStatusEnum.Started && typed.socialData.oauthUrl) {
+      if (!isSafeRedirectUrl(typed.socialData.oauthUrl)) {
+        return Err(CorbadoError.invalidConfig());
+      }
+
       window.location.href = typed.socialData.oauthUrl;
 
       return null;

packages/web-core/src/utils/helpers/index.ts

@@ -1,2 +1,3 @@
 export * from './getEmailLinkToken';
 export * from './base64';
+export * from './urlValidation';

packages/web-core/src/utils/helpers/urlValidation.ts

@@ -0,0 +1,52 @@
+const LOCALHOST_HOSTNAMES = ['localhost', '127.0.0.1', '[::1]'];
+
+/**
+ * Returns true if the hostname is a local development host for which we allow the
+ * insecure http: scheme. Everything else must be https:.
+ */
+const isLocalhost = (hostname: string): boolean => LOCALHOST_HOSTNAMES.includes(hostname);
+
+/**
+ * Validates a URL that will be used as a navigation target (e.g. an OAuth redirect
+ * assigned to window.location.href).
+ *
+ * Only https: is permitted, with an explicit http: exception for localhost during
+ * development.
+ */
+export const isSafeRedirectUrl = (rawUrl: string): boolean => {
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return false;
+  }
+
+  if (url.protocol === 'https:') {
+    return true;
+  }
+
+  if (url.protocol === 'http:' && isLocalhost(url.hostname)) {
+    return true;
+  }
+
+  return false;
+};
+
+/**
+ * Validates that a frontend API base URL is an acceptable origin.
+ *
+ * Only https: origins are allowed, with an http: exception for localhost during
+ * development.
+ */
+export const isSafeFrontendApiUrl = (rawUrl: string): boolean => isSafeRedirectUrl(rawUrl);
+
+/**
+ * Compares two URLs by origin. Returns false if either value is not a parseable URL.
+ */
+export const haveSameOrigin = (a: string, b: string): boolean => {
+  try {
+    return new URL(a).origin === new URL(b).origin;
+  } catch {
+    return false;
+  }
+};