fix: 로그인 returnTo를 오리진 정확 일치로 검사 by chanwoo7 · Pull Request #548 · CaQuick/caquick-be

chanwoo7 · 2026-11-01T01:02:02Z

개요

로그인 returnTo 검사가 접두 비교(startsWith)라서 허용 도메인으로 시작하기만 하면 다른 호스트도 통과했습니다. 오리진이 정확히 같을 때만 허용하도록 바꿉니다.

예: https://caquick.site.evil.com, https://caquick.site@evil.com, https://caquick.siteevil.com이 모두 허용됐습니다.
리다이렉트 URL에 토큰을 싣지는 않아 토큰 유출은 없고, 로그인 직후 외부 사이트로 보낼 수 있는 오픈 리다이렉트였습니다.
caquick.com을 허용 목록에 추가하면 같은 우회가 .com에도 생기므로 도메인 이전과 함께 막습니다.

변경 사항

helpers/return-to.helper.ts: returnTo를 URL로 파싱해 http(s)이고 오리진이 허용 목록(기본 프론트 주소 포함)과 정확히 같을 때만 그 주소를, 아니면 기본 프론트 주소를 돌려줍니다.
OidcLoginService.normalizeReturnTo가 이 헬퍼를 씁니다.

테스트

return-to.helper.spec.ts(it.each 표)
- 허용: 허용 오리진 경로, 쿼리, 앞뒤 공백
- 기본 주소로: 접두 같은 다른 호스트, userinfo 위장, 이어 붙인 호스트, 스킴·포트 불일치, //evil.com, 상대 경로, javascript:, 빈 값·공백·undefined
반증: 헬퍼를 옛 접두 비교로 바꾸면 우회 3종과 공백 케이스 등 4건이 실패합니다.

플랜 대조

플랜 1단계 `fix/oidc-return-to-origin-match` 불릿	상태
URL을 파싱해 오리진이 정확히 일치할 때만 허용	한 것
회귀 테스트: 접두 일치 우회·`@` 우회 주소가 기본값으로 떨어지는지	한 것

접두 비교라 caquick.site.evil.com·caquick.site@evil.com 같은 주소가 통과해 로그인 뒤 외부로 보낼 수 있었다. URL로 파싱해 http(s)이고 오리진이 허용 목록과 같을 때만 그 주소를 쓴다. - return-to.helper.ts 추가, OidcLoginService.normalizeReturnTo가 사용 - 회귀 테스트 15건(it.each 표: 허용 3·거부 11·기본 주소 오리진 1)

coderabbitai · 2026-11-01T01:02:10Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: CaQuick/caquick-be
Branch: fix/oidc-return-to-origin-match
File: .coderabbit.yaml
Commit: e4d8994
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 2c963bc7-b9a3-4ce3-9f42-aa1701248ee1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

chatgpt-codex-connector · 2026-11-01T01:02:27Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-01T01:03:22.107453Z	`e4d8994`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

github-actions · 2026-11-01T01:03:06Z

🧹 knip — dead-code 리포트

요약 항목 없음

전체 리포트

(knip 출력 없음 — 이슈 0이거나 실행 실패)

청소 후보(오탐 가능) · 기준 docs/guide/architecture-conventions.md

github-actions · 2026-11-01T01:03:19Z

🩺 NestJS Doctor — 90/100 (Excellent)

진단 493건 (error 13).

Category	error	warning	info
architecture	1	1	44
correctness	0	269	0
performance	0	41	28
schema	0	0	76
security	12	21	0

architecture / security 상위 항목

error security/security/no-hardcoded-secrets: Variable 'SEED_PASSWORD' appears to contain a hardcoded secret.
error architecture/architecture/no-manual-instantiation: Manual instantiation of 'OutboxRepository' detected. Use dependency injection instead.
info architecture/architecture/no-barrel-export-internals: Barrel file re-exports internal type 'IAuditLogRepository'.
warning security/security/no-exposed-env-vars: Direct 'process.env.NODE_ENV' access in 'AuthController'. Use ConfigService instead.
warning security/security/require-guards-on-endpoints: Endpoint 'start' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'callback' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'refresh' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'logout' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'sellerLogin' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'sellerRefresh' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'sellerLogout' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'devIssueToken' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'adminLogin' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'adminRefresh' has no @UseGuards() at class or method level.
warning security/security/require-guards-on-endpoints: Endpoint 'adminLogout' has no @UseGuards() at class or method level.

오탐 포함 가능 · 기준 docs/guide/architecture-conventions.md

github-actions · 2026-11-01T01:05:21Z

Coverage report

St.^❔	Category	Percentage	Covered / Total
🟢	Statements	98.02% (+0.01% 🔼)	10812/11030
🟢	Branches	92.97% (+0.03% 🔼)	4124/4436
🟢	Functions	97.56% (+0% 🔼)	2157/2211
🟢	Lines	98.6% (+0% 🔼)	9835/9975

Show new covered files 🐣

St.^❔	File	Statements	Branches	Functions	Lines
🟢	`...` / return-to.helper.ts	100%	100%	100%	100%

Show files with reduced coverage 🔻

St.^❔	File	Statements	Branches	Functions	Lines
🟢	`...` / oidc-login.service.ts	97.4% (-0.13% 🔻)	93.75% (-0.99% 🔻)	92.31% (-0.55% 🔻)	98.65% (-0.04% 🔻)

Test suite run success

4333 tests passing in 389 suites.

Report generated by 🧪jest coverage report action from e4d8994

codecov · 2026-11-01T01:05:35Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

chanwoo7 merged commit 2fb5317 into develop Nov 1, 2026
18 checks passed

chanwoo7 deleted the fix/oidc-return-to-origin-match branch November 1, 2026 01:05

chanwoo7 mentioned this pull request Nov 1, 2026

chore: 릴리즈 — caquick.com 도메인 허용·returnTo 오리진 검사 #549

Merged

Navigation Menu

Repository navigation

fix: 로그인 returnTo를 오리진 정확 일치로 검사 - #548

fix: 로그인 returnTo를 오리진 정확 일치로 검사#548
chanwoo7 merged 1 commit into
developfrom
fix/oidc-return-to-origin-match

chanwoo7 commented Nov 1, 2026

Uh oh!

coderabbitai Bot commented Nov 1, 2026

Review skipped

Uh oh!

chatgpt-codex-connector Bot commented Nov 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 1, 2026

Uh oh!

github-actions Bot commented Nov 1, 2026

Uh oh!

github-actions Bot commented Nov 1, 2026

Uh oh!

codecov Bot commented Nov 1, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

chanwoo7 commented Nov 1, 2026

개요

변경 사항

테스트

플랜 대조

Uh oh!

coderabbitai Bot commented Nov 1, 2026

Review skipped

Uh oh!

chatgpt-codex-connector Bot commented Nov 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

github-actions Bot commented Nov 1, 2026

🧹 knip — dead-code 리포트

Uh oh!

github-actions Bot commented Nov 1, 2026

🩺 NestJS Doctor — 90/100 (Excellent)

Uh oh!

github-actions Bot commented Nov 1, 2026

Coverage report

Test suite run success

Uh oh!

codecov Bot commented Nov 1, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chatgpt-codex-connector Bot commented Nov 1, 2026 •

edited

Loading