set redirect URI matching to strict by default

8 years ago · 2f31ceddf8
2 changed files with 3 additions and 1 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@ -1,5 +1,7 @@
 Unreleased:
 	- Added changelog
+	- Set default redirect URI resolver strict matching to true
+	- Fixed XSS vulnerability on redirect URI display on approval page

 *1.3.1*:
 	- Added End Session endpoint
--- a/openid-connect-server/src/main/java/org/mitre/oauth2/service/impl/BlacklistAwareRedirectResolver.java
+++ b/openid-connect-server/src/main/java/org/mitre/oauth2/service/impl/BlacklistAwareRedirectResolver.java
@ -47,7 +47,7 @@ public class BlacklistAwareRedirectResolver extends DefaultRedirectResolver {
 	@Autowired
 	private ConfigurationPropertiesBean config;

-	private boolean strictMatch = false;
+	private boolean strictMatch = true;

 	/* (non-Javadoc)
 	 * @see org.springframework.security.oauth2.provider.endpoint.RedirectResolver#resolveRedirect(java.lang.String, org.springframework.security.oauth2.provider.ClientDetails)