goauthentik / goauthentik/authentik

Using a wildcard regex in the port part of a redirect URI causes a ValueError

Open
#13,023 2 comments 0 reactions 0 assignees View on GitHub
bug bug/confirmed
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

**Describe the bug**
Using a `http://host:port.*`-like regex pattern as a authorized redirect URI causes a system error when hitting a token endpoint. Authentik presumably tries to parse out a port number from the regex.

**To Reproduce**
Steps to reproduce the behavior:
1. Create app+ OAuth2 provider
2. Set authorized redirect URIs to `http://localhost:4200.*` (regex-type)
3. Try to do a authorization-login
4. See error

**Expected behavior**
Either the request works, or a form validation when setting authorized URIs prevents using this kind of pattern

**Screenshots**
Not applicable

**Logs**

Stacktrace from authentik

```
Traceback (most recent call last):
File "/ak-root/venv/lib/python3.12/site-packages/asgiref/sync.py", line 518, in thread_handler
raise exc_info[1]
File "/ak-root/venv/lib/python3.12/site-packages/django/core/handlers/base.py", line 253, in _get_response_async
response = await wrapped_callback(
^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/asgiref/sync.py", line 468, in __call__
ret = await asyncio.shield(exec_coro)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/asgiref/current_thread_executor.py", line 40, in run
result = self.fn(*self.args, **self.kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/asgiref/sync.py", line 522, in thread_handler
return func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/django/views/generic/base.py", line 104, in view
return self.dispatch(request, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/django/utils/decorators.py", line 48, in _wrapper
return bound_method(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/django/views/decorators/csrf.py", line 65, in _view_wrapper
return view_func(request, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/authentik/providers/oauth2/views/token.py", line 564, in dispatch
cors_allow(self.request, response, *allowed_origins)
File "/authentik/providers/oauth2/utils.py", line 50, in cors_allow
and received_origin.port == url.port
^^^^^^^^
File "/usr/local/lib/python3.12/urllib/parse.py", line 182, in port
raise ValueError(f"Port could not be cast to integer value as {port!r}")
builtins.ValueError: Port could not be cast to integer value as '4200.*'
```

**Version and Deployment (please complete the following information):**
- authentik version: 2024.12.3
- Deployment: [e.g. docker-compose, helm]

**Additional context**
I'd argue that parsing part of a regex as a port number kind of misleads that the authorized URI is a regex pattern, since you could also do e.g. `http://example.com:123[4-9]/callback`, or plenty of other things.

Contributor guide

Open the contributing guide

Research direction

Start in authentik/providers/oauth2/utils.py at cors_allow, then trace its call from authentik/providers/oauth2/views/token.py. Reproduce the authorization flow with an authorized redirect URI such as http://localhost:4200.* and inspect how the URL port is parsed. Done means the reported ValueError is handled according to the chosen expected behavior, with regression coverage for this pattern.

Written by the indexing model from the issue text.

Assessment

Tech stack
django, python
Domain
api, authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.