clj-commons / friend Goto Github PK

https://nvd.nist.gov/vuln/detail/CVE-2015-0886

A long time ago, they changed friend from using relative URLs to absolute for redirects: cemerick@5b04323

The default :login-uri is /login, which gets used in the "Location" header when generating redirects. Browsers may accept this, but it is not valid according to the HTTP spec, which requires an absolute URI.

However, this broke redirects, in case there's a proxy or a load balancer in front of the app terminating SSL/TLS: cemerick#84

The argument that "it is not valid according to the HTTP spec" hasn't been true for a long time.
There's an updated HTTP spec that allows using relative URLs for redirects: https://datatracker.ietf.org/doc/html/rfc7231#section-7.1.2

I suggest changing the code so it uses relative URLs for redirects again. That way, it will work out of the box.

Other resources:

• https://en.wikipedia.org/wiki/HTTP_location
• https://stackoverflow.com/questions/25652718/do-relative-server-side-redirects-respect-the-protocol

The link to the demo app in the readme is broken: http://friend-demo.herokuapp.com.