Redmine

The OAuth provider requires HTTPS for redirect URIs, except for loopback hosts. The exemption compares the host name literally, so a subdomain of .localhost is rejected.

Steps to reproduce¶

1. Go to Administration > Applications > New application
2. Enter http://myapp.localhost:3000/callback as Redirect URI and save

Result: "Redirect URI must be an HTTPS/SSL URI."
Expected: the URI is accepted, like http://localhost:3000/callback is.

Why it matters¶

.localhost is reserved for loopback by RFC 6761, and browsers resolve *.localhost to the loopback address without any DNS or hosts file setup. It is common, at least for us, to run several local applications as app-name.localhost to keep cookies and sessions apart, so an OAuth client under development often has such a callback URL.

Change¶

The attached patch also exempts host names ending in .localhost:

force_ssl_in_redirect_uri do |uri|
  hostname = uri.hostname.to_s
  !(%w[localhost 127.0.0.1 ::1].include?(hostname) || hostname.end_with?('.localhost'))
end

Hosts that merely contain the word, such as localhost.example.com or notlocalhost, still require HTTPS.

The patch is against current trunk and includes a unit test covering the allowed loopback hosts and the rejected look-alikes.