Merge pull request bitly#194 from r4um/validate-state

Validate state param while redirecting.
yawboateng · Jan 19, 2016 · d5a332c · d5a332c
2 parents 613a342 + f957a1e
commit d5a332c
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/oauthproxy.go b/oauthproxy.go
@@ -476,7 +476,7 @@ func (p *OAuthProxy) OAuthCallback(rw http.ResponseWriter, req *http.Request) {
 	}
 
 	redirect := req.Form.Get("state")
-	if redirect == "" {
+	if !strings.HasPrefix(redirect, "/") {
 		redirect = "/"
 	}