5 ms·

> The vulnerability affects all OAuth 2.0 clients configured with a redirect URI ending with a * in Keycloak < 23.0.4. How common is a wildcard in a redirect U

• pwntus_se 3y ago
  I've seen it in multiple installs, and it's used by keycloak's default clients used for the admin app and for the account portals for realms.
• Klathmon 3y ago
  It's pretty common in my experience, especially at places that have multiple "apps" behind the same auth.
• pwntus_se 3y ago
  However, stealing access tokens is only possible with public clients. The open redirect works on both public and confidential clients.
• maxwellg 3y ago
  IME Wildcard redirect URLs have become more common in recent years due to the rise of preview environments. If you're deploying a git branch to Vercel, and you now want to log in to <project-name>-git-<branch-name>-<scope-slug>.vercel.app, then you don't want to bother with configuring a different redirect URL for every branch name. Enter the wildcard. Ideally wildcards are only used in dev/staging environments, but if the system allows for misconfiguration, the system will be misconfigured.
• jdsleppy 3y ago
  I use it to allow a ?next={url} query parameter in the redirect so I can send users to the page they originally wanted to visit. It becomes more important the faster the access tokens expire because a user can reauth multiple times in a session. The other way might be to put that URL in redis or something, maybe that's better?
  • pwntus_se 3y ago
    You could store that information in the client. Store a reference from the value of the state parameter to the deep link url you want. https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1 https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1