OAuth2 Application redirect URL with https, but it becomes contains some 'redirect' query params in url. #11590

New Issue

GiteaMirror · 2025-11-02T09:41:56-06:00

GiteaMirror commented

2025-11-02 09:41:56 -06:00

Originally created by @mei-rune on GitHub (Sep 4, 2023).

Description

my request url is http://127.0.0.1/xxxxx/oauth/login_callback?redirect=http%3a%2f%2f127.0.0.1%2flogin

my validate url in gitea is "http://127.0.0.1/xxxxx/oauth/login_callback"

I fix it with :

diff --git a/models/auth/oauth2.go b/models/auth/oauth2.go
index 01ec23a5a..8976bbc3d 100644
--- a/models/auth/oauth2.go
+++ b/models/auth/oauth2.go
@@ -54,6 +54,10 @@ func (app *OAuth2Application) TableName() string {
 // ContainsRedirectURI checks if redirectURI is allowed for app
 func (app *OAuth2Application) ContainsRedirectURI(redirectURI string) bool {
        contains := func(s string) bool {
+               if idx := strings.Index(s, "?"); idx > 0 {
+                       s = s[:idx]
+               }
+
                s = strings.TrimSuffix(strings.ToLower(s), "/")
                for _, u := range app.RedirectURIs {
                        if strings.TrimSuffix(strings.ToLower(u), "/") == s {

Gitea Version

1.20.0

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

Git Version

No response

Operating System

No response

How are you running Gitea?

run it as service in the windows

Database

SQLite

Originally created by @mei-rune on GitHub (Sep 4, 2023). ### Description my request url is http://127.0.0.1/xxxxx/oauth/login_callback?redirect=http%3a%2f%2f127.0.0.1%2flogin my validate url in gitea is "http://127.0.0.1/xxxxx/oauth/login_callback" I fix it with : ````patch diff --git a/models/auth/oauth2.go b/models/auth/oauth2.go index 01ec23a5a..8976bbc3d 100644 --- a/models/auth/oauth2.go +++ b/models/auth/oauth2.go @@ -54,6 +54,10 @@ func (app *OAuth2Application) TableName() string { // ContainsRedirectURI checks if redirectURI is allowed for app func (app *OAuth2Application) ContainsRedirectURI(redirectURI string) bool { contains := func(s string) bool { + if idx := strings.Index(s, "?"); idx > 0 { + s = s[:idx] + } + s = strings.TrimSuffix(strings.ToLower(s), "/") for _, u := range app.RedirectURIs { if strings.TrimSuffix(strings.ToLower(u), "/") == s { ```` ### Gitea Version 1.20.0 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots ![图片](https://github.com/go-gitea/gitea/assets/1052632/349ac7f1-a2c5-4aa3-8f37-76c91c5e01f3) ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? run it as service in the windows ### Database SQLite

GiteaMirror added the issue/not-a-bug label 2025-11-02 09:41:56 -06:00

GiteaMirror closed this issue

2025-11-02 09:41:56 -06:00

GiteaMirror commented

2025-11-02 09:41:57 -06:00

@OctopusET commented on GitHub (Apr 7, 2024):

Try <your-hostname>/user/oauth2/<name-of-client>/callback instead

@OctopusET commented on GitHub (Apr 7, 2024): Try `<your-hostname>/user/oauth2/<name-of-client>/callback` instead

GiteaMirror commented

2025-11-02 09:41:57 -06:00

@mei-rune commented on GitHub (Apr 7, 2024):

Try <your-hostname>/user/oauth2/<name-of-client>/callback instead

I know it, but i hope pass a argument 'redirect'

@mei-rune commented on GitHub (Apr 7, 2024): > Try `<your-hostname>/user/oauth2/<name-of-client>/callback` instead I know it, but i hope pass a argument 'redirect'

GiteaMirror commented

2025-11-02 09:41:57 -06:00

@lunny commented on GitHub (Apr 8, 2024):

Please send a PR.

@lunny commented on GitHub (Apr 8, 2024): Please send a PR.

GiteaMirror commented

2025-11-02 09:41:57 -06:00

@mei-rune commented on GitHub (Apr 8, 2024):

I send a PR.

@mei-rune commented on GitHub (Apr 8, 2024): I send a PR.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#11590