Ability to restrict redirection by domain

[seanlinsley]

During gratipay/gratipay.com#2138 I thought the ability to restrict the domain(s) allowed during redirection might be a nice feature to have in Aspen. For example:

request.redirect(foo, local_only=True) # only allows the current domain

request.redirect(foo, domains=('example.com',)) # only allows example.com

[chadwhitacre]

@seanlinsley This is security-related, right? Can you unpack more of the motivation behind this feature? And what would we do in the case where a redirect is not allowed?

[seanlinsley]

This is specifically useful for code that relies on arbitrary client-provided redirects. If an attacker can get you to visit their site by hijacking that redirect, they can do all sorts of things. Going back to the original ticket: gratipay/gratipay.com#30 (comment) is a concern.

As for what to do when you run across an invalid redirect, I don't know, throw a 500?

[seanlinsley]

Going back to the original ticket: gratipay/gratipay.com#30 (comment) is a concern.

Hmm, rereading that I guess that's not the case. I'm not a professional security researcher, so I'm really not the one to ask IRT possible attack vectors. At the very least, it could enable phishing.

[pjz]

It can also enable... redirects. Like, you know, if you want to write a bit.ly clone with aspen. Also, the suggested code could easily be:

if not redirects_to_localhost(foo):
    raise Response(400, "Not allowed to redirect offsite.")
request.redirect(foo)

Which allows for much more flexible handling of the offsite-redirect case.

This is, IMO, not a problem that the framework can solve any better than the application can.

[seanlinsley]

This is, IMO, not a problem that the framework can solve any better than the application can.

If you make security hard, everyone is going to have insecure applications.

[pjz]

If you want security, stop using user input for a redirect location!

[seanlinsley]

AFAICT client-provided redirects are required for OAuth, at the very least

[pjz]

I guess. PRs accepted.

[chadwhitacre]

Actually, after spending more time with gratipay/gratipay.com#2138, I think what's wanted here is to set website.base_url or some such, and always prefix that to locations passed in to request.redirect (and response.redirect, if we ever upstream that).