bb-plane-fork/apps/api/plane/authentication
Nikhil 6d3d9e6df7
[WEB-4943]: add url has allowed host or scheme for validating valid redirections (#7809)
* feat: enhance path validation and URL safety in path_validator.py

* Added get_allowed_hosts function to retrieve allowed hosts from settings.
* Updated get_safe_redirect_url to validate URLs against allowed hosts.
* Improved URL construction logic for safer redirection handling.

* feat: enhance URL validation in authentication views

* Added url_has_allowed_host_and_scheme checks in SignUpAuthSpaceEndpoint and MagicSignInSpaceEndpoint for safer redirection.
* Updated redirect logic to fallback to base host if the constructed URL is not allowed.
* Improved overall URL safety and handling in authentication flows.

* fix: improve host extraction in get_allowed_hosts function

* Updated get_allowed_hosts to extract only the host from ADMIN_BASE_URL and SPACE_BASE_URL settings for better URL validation.
* Enhanced overall safety and clarity in allowed hosts retrieval.
2025-09-16 21:37:08 +05:30
..
adapter chore: rename server to api (#7342) 2025-07-04 15:32:21 +05:30
middleware chore: rename server to api (#7342) 2025-07-04 15:32:21 +05:30
provider [WEB-4045] feat: restructuring of the external APIs for better maintainability (#7477) 2025-07-25 00:17:05 +05:30
utils chore: rename server to api (#7342) 2025-07-04 15:32:21 +05:30
views [WEB-4943]: add url has allowed host or scheme for validating valid redirections (#7809) 2025-09-16 21:37:08 +05:30
__init__.py chore: rename server to api (#7342) 2025-07-04 15:32:21 +05:30
apps.py chore: rename server to api (#7342) 2025-07-04 15:32:21 +05:30
rate_limit.py chore: rename server to api (#7342) 2025-07-04 15:32:21 +05:30
session.py chore: rename server to api (#7342) 2025-07-04 15:32:21 +05:30
urls.py chore: rename server to api (#7342) 2025-07-04 15:32:21 +05:30