From cc00c64c9ee41f5710f408487890d34a5d175ca1 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sat, 10 Oct 2026 20:07:47 +0200 Subject: [PATCH] Startup validation: an allowed origin with user info is refused Co-Authored-By: Claude Opus 5.5 --- .../Features/Shared/StartupConfigurationValidator.cs | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/Bifrost.Web/Features/Shared/StartupConfigurationValidator.cs b/src/Bifrost.Web/Features/Shared/StartupConfigurationValidator.cs index 4d7cab9..c511413 100644 --- a/src/Bifrost.Web/Features/Shared/StartupConfigurationValidator.cs +++ b/src/Bifrost.Web/Features/Shared/StartupConfigurationValidator.cs @@ -103,10 +103,11 @@ public sealed class StartupConfigurationValidator( } } - // The authority form is the canonical spelling, so a wildcard, path, query, user info, upper-case host or - // default port differs from it and is refused. + // The authority form is the canonical spelling, so a wildcard, path, query, upper-case host or default port + // differs from it and is refused; user info is part of the authority, so it is refused on its own. private static bool IsExactHttpsOrigin(string? origin) => Uri.TryCreate(origin, UriKind.Absolute, out var uri) && uri.Scheme == Uri.UriSchemeHttps && + uri.UserInfo.Length == 0 && string.Equals(uri.GetLeftPart(UriPartial.Authority), origin, StringComparison.Ordinal); }