fix(iframe-app): prevent client-side open redirect in EasyAuth login popup

apps/iframe-app/src/lib/__tests__/authHandler.test.ts

@@ -334,6 +334,75 @@ describe('authHandler', () => {
       expect(onFailed).toHaveBeenCalled();
     });
 
+    it('should allow login popup for a trusted Logic Apps domain on a different origin', () => {
+      const mockPopup = { closed: false, close: vi.fn(), location: { href: '' } };
+      mockWindowOpen.mockReturnValueOnce(mockPopup);
+
+      openLoginPopup({
+        baseUrl: 'https://contoso.logic.azure.com',
+        signInEndpoint: '/.auth/login/aad',
+      });
+
+      expect(mockWindowOpen).toHaveBeenCalledWith(
+        'https://contoso.logic.azure.com/.auth/login/aad',
+        'auth-login',
+        'width=600,height=700,popup=true'
+      );
+    });
+
+    it('should block login popup that redirects to an untrusted origin', () => {
+      const onFailed = vi.fn();
+
+      openLoginPopup({
+        baseUrl: 'https://evil.example.net',
+        signInEndpoint: '/.auth/login/aad',
+        onFailed,
+      });
+
+      expect(mockWindowOpen).not.toHaveBeenCalled();
+      expect(onFailed).toHaveBeenCalledWith(expect.any(Error));
+    });
+
+    it('should block a sign-in endpoint that escapes the base origin via userinfo', () => {
+      const onFailed = vi.fn();
+
+      // `${baseUrl}${signInEndpoint}` => https://example.com@evil.example.net/... (origin becomes evil.example.net)
+      openLoginPopup({
+        baseUrl: 'https://example.com',
+        signInEndpoint: '@evil.example.net/.auth/login/aad',
+        onFailed,
+      });
+
+      expect(mockWindowOpen).not.toHaveBeenCalled();
+      expect(onFailed).toHaveBeenCalledWith(expect.any(Error));
+    });
+
+    it('should block a non-https login popup URL on a non-localhost host', () => {
+      const onFailed = vi.fn();
+
+      openLoginPopup({
+        baseUrl: 'http://contoso.logic.azure.com',
+        signInEndpoint: '/.auth/login/aad',
+        onFailed,
+      });
+
+      expect(mockWindowOpen).not.toHaveBeenCalled();
+      expect(onFailed).toHaveBeenCalledWith(expect.any(Error));
+    });
+
+    it('should block a malformed login popup URL', () => {
+      const onFailed = vi.fn();
+
+      openLoginPopup({
+        baseUrl: 'not-a-valid-url',
+        signInEndpoint: '/.auth/login/aad',
+        onFailed,
+      });
+
+      expect(mockWindowOpen).not.toHaveBeenCalled();
+      expect(onFailed).toHaveBeenCalledWith(expect.any(Error));
+    });
+
     it('should call onSuccess when login succeeds and popup closes', async () => {
       vi.useFakeTimers();
 

apps/iframe-app/src/lib/authHandler.ts

@@ -202,6 +202,54 @@ export async function checkAuthStatus(baseUrl: string): Promise<AuthInformation>
 // Public API - Login Popup
 // ============================================================================
 
+/**
+ * Trusted Microsoft Logic Apps domains that the login popup is allowed to navigate to
+ * in addition to the hosting page's own origin. Kept in sync with the agent card
+ * allowlist in `config-parser.ts`.
+ */
+const ALLOWED_LOGIN_DOMAINS = ['.logic.azure.com', '.logic-apps.azure.com'];
+
+/**
+ * Normalizes and validates a login popup URL to prevent client-side open-redirect
+ * (a.k.a. `window.open` hijacking). The URL — which is built from the potentially
+ * user-influenced `baseUrl`/`signInEndpoint` values — is parsed into a `URL` object
+ * and then strictly matched against the current origin or a trusted domain allowlist.
+ *
+ * @returns the canonicalized, safe URL string, or `null` if the URL is untrusted/invalid.
+ */
+function getValidatedLoginUrl(loginUrl: string): string | null {
+  let parsed: URL;
+  try {
+    parsed = new URL(loginUrl);
+  } catch {
+    return null;
+  }
+
+  const hostname = parsed.hostname.toLowerCase();
+  const isLocalhostHost = hostname === 'localhost' || hostname === '127.0.0.1';
+
+  // Only https is allowed, except http on localhost during local development.
+  if (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && isLocalhostHost)) {
+    return null;
+  }
+
+  // Same origin as the hosting page is always trusted — EasyAuth lives on the app's own origin.
+  if (parsed.origin === window.location.origin) {
+    return parsed.href;
+  }
+
+  // localhost is only trusted when the app itself is running locally.
+  if (isLocalhostHost) {
+    const isLocalDevelopment = window.location.hostname === 'localhost' || window.location.hostname === '127.0.0.1';
+    return isLocalDevelopment ? parsed.href : null;
+  }
+
+  // Otherwise the host must belong to a trusted Microsoft Logic Apps domain.
+  const isTrustedDomain = ALLOWED_LOGIN_DOMAINS.some((domain) => hostname === domain.slice(1) || hostname.endsWith(domain));
+
+  return isTrustedDomain ? parsed.href : null;
+}
+
 /**
  * Opens login popup for Azure App Service EasyAuth and monitors for completion.
  * Supports dynamic identity providers via the signInEndpoint parameter.
@@ -216,7 +264,15 @@ export function openLoginPopup(options: LoginPopupOptions): void {
     loginUrl += `?post_login_redirect_uri=${encodeURIComponent(postLoginRedirectUri)}`;
   }
 
-  const popup = window.open(loginUrl, 'auth-login', 'width=600,height=700,popup=true');
+  // Validate the (potentially user-influenced) URL before navigating to guard against
+  // client-side open-redirect via crafted base URL or sign-in endpoint values.
+  const validatedLoginUrl = getValidatedLoginUrl(loginUrl);
+  if (!validatedLoginUrl) {
+    onFailed?.(new Error('Blocked login popup with an untrusted or invalid URL.'));
+    return;
+  }
+
+  const popup = window.open(validatedLoginUrl, 'auth-login', 'width=600,height=700,popup=true');
 
   if (!popup) {
     onFailed?.(new Error('Failed to open login popup'));