[PR #1012] [CLOSED] feat: RFC 8252 loopback interface redirection support #1023

New Issue

OVERLORD · 2026-02-04T21:11:33+03:00

OVERLORD commented

2026-02-04 21:11:33 +03:00

📋 Pull Request Information

Original PR: https://github.com/pocket-id/pocket-id/pull/1012
Author: @savely-krasovsky
Created: 10/8/2025
Status: ❌ Closed

Base: main ← Head: rfc8252-special-case

📝 Commits (3)

0e96991 feat: RFC 8252 loopback interface redirection support
b826867 Merge branch 'main' into rfc8252-special-case
3fc9f0b Merge branch 'main' into rfc8252-special-case

📊 Changes

3 files changed (+118 additions, -18 deletions)

View changed files

📝 backend/internal/service/oidc_service.go (+2 -18)
📝 backend/internal/utils/string_util.go (+48 -0)
📝 backend/internal/utils/string_util_test.go (+68 -0)

📄 Description

Support for special Callback URL case which is primary used by Desktop Native Applications.
https://datatracker.ietf.org/doc/html/rfc8252#section-7.3

Their unique feature is that they can use any ephemeral port they want. So it could be 23821 or 54231. Of course they send it in redirect_url. Until recently it was possible to set http://127.0.0.1:* and http://[::1]:* (or http://localhost:*) to work around this but now it's impossible due to the new form validation:

But still it presets a huge vulnerability, since http://localhost:* basically allows to craft authorization URL with callback URL like this: http://localhost:password@malicious-host.com/authorization_code_stealer.

Fortunately RFC 8252 defines this special case by specifying that ephemeral port could be completely random and authorization server should allow any arbitrary port.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/pocket-id/pocket-id/pull/1012 **Author:** [@savely-krasovsky](https://github.com/savely-krasovsky) **Created:** 10/8/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `rfc8252-special-case` --- ### 📝 Commits (3) - [`0e96991`](https://github.com/pocket-id/pocket-id/commit/0e969913f117e7c611418806bbcc86cc16f0b0e3) feat: RFC 8252 loopback interface redirection support - [`b826867`](https://github.com/pocket-id/pocket-id/commit/b8268673cfb4ee3f86a5a26af43fffc409943756) Merge branch 'main' into rfc8252-special-case - [`3fc9f0b`](https://github.com/pocket-id/pocket-id/commit/3fc9f0b40b574d29b16dcdeeae830425d6a293d7) Merge branch 'main' into rfc8252-special-case ### 📊 Changes **3 files changed** (+118 additions, -18 deletions) <details> <summary>View changed files</summary> 📝 `backend/internal/service/oidc_service.go` (+2 -18) 📝 `backend/internal/utils/string_util.go` (+48 -0) 📝 `backend/internal/utils/string_util_test.go` (+68 -0) </details> ### 📄 Description Support for special Callback URL case which is primary used by Desktop Native Applications. https://datatracker.ietf.org/doc/html/rfc8252#section-7.3 Their unique feature is that they can use any ephemeral port they want. So it could be 23821 or 54231. Of course they send it in `redirect_url`. Until recently it was possible to set `http://127.0.0.1:*` and `http://[::1]:*` (or `http://localhost:*`) to work around this but now it's impossible due to the new form validation: <img width="637" height="222" alt="image" src="https://github.com/user-attachments/assets/94d68b91-47b3-4598-b437-0cc77807670a" /> But still it presets a huge vulnerability, since `http://localhost:*` basically allows to craft authorization URL with callback URL like this: `http://localhost:password@malicious-host.com/authorization_code_stealer`. Fortunately RFC 8252 defines this special case by specifying that ephemeral port could be completely random and authorization server should allow any arbitrary port. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

OVERLORD added the pull-request label 2026-02-04 21:11:33 +03:00

OVERLORD closed this issue

2026-02-04 21:11:35 +03:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#1023