Merge commit from fork

* Fix redirect URI allowlist bypass via URL userinfo syntax * Validate redirect URIs against normalized origin+pathname
2026-03-11 13:33:00 +01:00
parent b9a41c0a22
commit 0f9d673e82
3 changed files with 46 additions and 14 deletions
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Improved redirect URI validation in the experimental OIDC provider to match against normalized URLs rather than raw strings.