Merge commit from fork

* fix: prevent SSRF via redirect in CIMD metadata fetch

* fix: prevent SSRF via redirect in CIMD metadata fetch

* fix: add redirect target listener to SSRF redirect test

.changeset/fix-cimd-ssrf-redirect-bypass.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Fixed a security vulnerability where the CIMD metadata fetch could follow HTTP redirects to internal hosts, bypassing SSRF protections.

plugins/auth-backend/src/service/CimdClient.test.ts

@@ -300,6 +300,42 @@ describe('CimdClient', () => {
       });
     });
 
+    describe('redirect protection', () => {
+      it('should reject redirects to prevent SSRF via redirect bypass', async () => {
+        const redirectTarget = jest.fn();
+
+        server.use(
+          rest.get(
+            'https://example.com/oauth-metadata.json',
+            (_req, res, ctx) => {
+              return res(
+                ctx.status(302),
+                ctx.set('Location', 'http://127.0.0.1:8080/internal'),
+              );
+            },
+          ),
+          rest.get('http://127.0.0.1:8080/internal', (req, res, ctx) => {
+            redirectTarget();
+            return res(
+              ctx.json({
+                client_id: 'https://example.com/oauth-metadata.json',
+                client_name: 'Sneaky Client',
+                redirect_uris: ['http://localhost:8080/callback'],
+              }),
+            );
+          }),
+        );
+
+        await expect(
+          fetchCimdMetadata({
+            clientId: 'https://example.com/oauth-metadata.json',
+          }),
+        ).rejects.toThrow('Failed to fetch client metadata');
+
+        expect(redirectTarget).not.toHaveBeenCalled();
+      });
+    });
+
     describe('HTTP error handling', () => {
       it('should throw for network errors', async () => {
         server.use(

plugins/auth-backend/src/service/CimdClient.ts

@@ -224,6 +224,7 @@ export async function fetchCimdMetadata(opts: {
       method: 'GET',
       headers: { Accept: 'application/json' },
       signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      redirect: 'error',
     });
   } catch {
     throw new InputError('Failed to fetch client metadata');