Ensure the redirect path starts with a slash (#210)

Author: ottokruse

src/lambda-edge/parse-auth/index.ts

@@ -30,7 +30,7 @@ export const handler: CloudFrontRequestHandler = async (event) => {
       cookies,
     });
     CONFIG.logger.debug("Query string and cookies are valid");
-    redirectedFromUri += requestedUri;
+    redirectedFromUri += common.ensureValidRedirectPath(requestedUri);
 
     const body = stringifyQueryString({
       grant_type: "authorization_code",

src/lambda-edge/refresh-auth/index.ts

@@ -76,9 +76,9 @@ export const handler: CloudFrontRequestHandler = async (event) => {
         location: [
           {
             key: "location",
-            value: `https://${domainName}${
-              typeof requestedUri === "string" ? requestedUri : "/"
-            }`,
+            value: `https://${domainName}${common.ensureValidRedirectPath(
+              requestedUri
+            )}`,
           },
         ],
         "set-cookie": common.generateCookieHeaders.refresh({

src/lambda-edge/shared/shared.ts

@@ -605,3 +605,8 @@ export function generateSecret(
     .map(() => allowedCharacters[randomInt(0, allowedCharacters.length)])
     .join("");
 }
+
+export function ensureValidRedirectPath(path: unknown) {
+  if (typeof path !== "string") return "/";
+  return path.startsWith("/") ? path : `/${path}`;
+}