feat: use uri-reference for errors redirect to allow relative urls (#516

)
ory · Sep 16, 2020 · 0d39674 · 0d39674
1 parent 26f1861
commit 0d39674
Show file tree

Hide file tree

Showing 2 changed files with 45 additions and 4 deletions.
diff --git a/.schema/config.schema.json b/.schema/config.schema.json
@@ -246,9 +246,14 @@
       "properties": {
         "to": {
           "title": "Redirect to",
-          "description": "Set the redirect target. Must be a http/https URL.",
+          "description": "Set the redirect target. Can either be a http/https URL, or a relative URL.",
           "type": "string",
-          "format": "uri"
+          "format": "uri-reference",
+          "examples": [
+            "http://my-app.com/dashboard",
+            "https://my-app.com/dashboard",
+            "/dashboard"
+          ]
         },
         "code": {
           "title": "HTTP Redirect Status Code",

diff --git a/pipeline/errors/error_redirect_test.go b/pipeline/errors/error_redirect_test.go
@@ -33,7 +33,7 @@ func TestErrorRedirect(t *testing.T) {
 			assert      func(t *testing.T, recorder *httptest.ResponseRecorder)
 		}{
 			{
-				d:          "should redirect with 302",
+				d:          "should redirect with 302 - absolute (HTTP)",
 				givenError: &herodot.ErrNotFound,
 				config:     `{"to":"http://test/test"}`,
 				assert: func(t *testing.T, rw *httptest.ResponseRecorder) {
@@ -42,14 +42,50 @@ func TestErrorRedirect(t *testing.T) {
 				},
 			},
 			{
-				d:          "should redirect with 301",
+				d:          "should redirect with 302 - absolute (HTTPS)",
+				givenError: &herodot.ErrNotFound,
+				config:     `{"to":"https://test/test"}`,
+				assert: func(t *testing.T, rw *httptest.ResponseRecorder) {
+					assert.Equal(t, 302, rw.Code)
+					assert.Equal(t, "https://test/test", rw.Header().Get("Location"))
+				},
+			},
+			{
+				d:          "should redirect with 302 - relative",
+				givenError: &herodot.ErrNotFound,
+				config:     `{"to":"/test"}`,
+				assert: func(t *testing.T, rw *httptest.ResponseRecorder) {
+					assert.Equal(t, 302, rw.Code)
+					assert.Equal(t, "/test", rw.Header().Get("Location"))
+				},
+			},
+			{
+				d:          "should redirect with 301 - absolute (HTTP)",
 				givenError: &herodot.ErrNotFound,
 				config:     `{"to":"http://test/test","code":301}`,
 				assert: func(t *testing.T, rw *httptest.ResponseRecorder) {
 					assert.Equal(t, 301, rw.Code)
 					assert.Equal(t, "http://test/test", rw.Header().Get("Location"))
 				},
 			},
+			{
+				d:          "should redirect with 301 - absolute (HTTPS)",
+				givenError: &herodot.ErrNotFound,
+				config:     `{"to":"https://test/test","code":301}`,
+				assert: func(t *testing.T, rw *httptest.ResponseRecorder) {
+					assert.Equal(t, 301, rw.Code)
+					assert.Equal(t, "https://test/test", rw.Header().Get("Location"))
+				},
+			},
+			{
+				d:          "should redirect with 301 - relative",
+				givenError: &herodot.ErrNotFound,
+				config:     `{"to":"/test", "code":301}`,
+				assert: func(t *testing.T, rw *httptest.ResponseRecorder) {
+					assert.Equal(t, 301, rw.Code)
+					assert.Equal(t, "/test", rw.Header().Get("Location"))
+				},
+			},
 		} {
 			t.Run(fmt.Sprintf("case=%d/description=%s", k, tc.d), func(t *testing.T) {
 				w := httptest.NewRecorder()