spring-projects / spring-projects/spring-security-samples

Suggested optimization: LoopbackIpRedirectFilter

Open
#114 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
1.8k
Forks
797
Avg merge
3m
Merged PRs (30d)
5

Description

\spring-security-samples\servlet\spring-boot\java\oauth2\login\src\main\java\example\filter\LoopbackIpRedirectFilter.java

Should not be configured:

if (request.getServerName().equals("localhost") && request.getHeader("host") != null) {
UriComponents uri = UriComponentsBuilder.fromHttpRequest(new ServletServerHttpRequest(request))
.host("127.0.0.1").build();
response.sendRedirect(uri.toUriString());
return;
}

In the oauth2 of Google login and GitHub login, there will be a prompt error that the callback address is different from the callback address configured by the application, and an error will be reported.

Because Google login does not allow setting the callback URL of 127.0.0.1, it needs a domain name, similar to localhost, but LoopbackIpRedirectFilter will change it to 127.0.0.1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with spring-security-samples/servlet/spring-boot/java/oauth2/login/src/main/java/example/filter/LoopbackIpRedirectFilter.java and inspect where it is configured in the OAuth2 login sample. Verify the Google and GitHub callback behavior, then ensure localhost callback URLs are not rewritten to 127.0.0.1.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring-boot
Domain
authentication
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.