1.0.36

src/routes/api/auth/oidc/[id]/initiate/+server.ts

@@ -2,6 +2,7 @@ import { json, redirect } from '@sveltejs/kit';
 import type { RequestHandler } from '@sveltejs/kit';
 import { buildOidcAuthorizationUrl, isAuthEnabled } from '$lib/server/auth';
 import { getOidcConfig } from '$lib/server/db';
+import { safeRedirectOrRoot } from '$lib/utils/safe-redirect';
 
 // GET /api/auth/oidc/[id]/initiate - Start OIDC authentication flow
 export const GET: RequestHandler = async ({ params, url }) => {
@@ -15,8 +16,8 @@ export const GET: RequestHandler = async ({ params, url }) => {
 		return json({ error: 'Invalid configuration ID' }, { status: 400 });
 	}
 
-	// Get redirect URL from query params
-	const redirectUrl = url.searchParams.get('redirect') || '/';
+	// Get redirect URL from query params (validated path-relative only)
+	const redirectUrl = safeRedirectOrRoot(url.searchParams.get('redirect'));
 
 	try {
 		const config = await getOidcConfig(id);
@@ -56,7 +57,7 @@ export const POST: RequestHandler = async ({ params, request }) => {
 
 	try {
 		const body = await request.json().catch(() => ({}));
-		const redirectUrl = body.redirect || '/';
+		const redirectUrl = safeRedirectOrRoot(body.redirect);
 
 		const config = await getOidcConfig(id);
 		if (!config || !config.enabled) {

src/routes/api/auth/oidc/callback/+server.ts

@@ -3,6 +3,7 @@ import type { RequestHandler } from '@sveltejs/kit';
 import { handleOidcCallback, createUserSession, isAuthEnabled } from '$lib/server/auth';
 import { auditAuth } from '$lib/server/audit';
 import { getClientIp } from '$lib/server/client-ip';
+import { safeRedirectOrRoot } from '$lib/utils/safe-redirect';
 
 // GET /api/auth/oidc/callback - Handle OIDC callback from IdP
 export const GET: RequestHandler = async (event) => {
@@ -54,8 +55,8 @@ export const GET: RequestHandler = async (event) => {
 			providerName: result.providerName
 		});
 
-		// Redirect to the original destination or home
-		const redirectUrl = result.redirectUrl || '/';
+		// Redirect to the original destination or home (validated path-relative)
+		const redirectUrl = safeRedirectOrRoot(result.redirectUrl);
 		throw redirect(302, redirectUrl);
 	} catch (error: any) {
 		// Re-throw redirect