feat: Allowing on RedirectURIs the usage of regexp due to issue #448.

Adding new flags for conditional logic and allowing back compatibility of the feature

Author: SGT911

Dockerfile

@@ -1,8 +1,8 @@
 ARG BASE_IMAGE=alpine
 
-FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.9.0@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707 AS xx
+FROM --platform=$BUILDPLATFORM docker.io/tonistiigi/xx:1.9.0@sha256:c64defb9ed5a91eacb37f96ccc3d4cd72521c4bd18d5442905b95e2226b0e707 AS xx
 
-FROM --platform=$BUILDPLATFORM golang:1.26.4-alpine3.22@sha256:727cfc3c40be55cd1bc9a4a059406b28a059857e3be752aa9d09531e12c20c56 AS builder
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.26.4-alpine3.22@sha256:727cfc3c40be55cd1bc9a4a059406b28a059857e3be752aa9d09531e12c20c56 AS builder
 
 COPY --from=xx / /
 

cmd/dex/serve.go

@@ -14,6 +14,7 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"regexp"
 	"runtime"
 	"strings"
 	"sync/atomic"
@@ -242,6 +243,18 @@ func runServe(options serveOptions) error {
 				}
 				c.StaticClients[i].Secret = os.Getenv(client.SecretEnv)
 			}
+			if client.InsecureAllowRegexpRedirectURIs {
+				for _, uri := range client.RedirectURIs {
+					if client.InsecureAllowWildcardRedirectURIs && strings.Contains(uri, ".*") {
+						return fmt.Errorf("invalid config: InsecureAllowWildcardRedirectURIs is required when using \".*\"")
+					}
+
+					_, err := regexp.Compile(uri)
+					if err != nil {
+						return fmt.Errorf("invalid config: RedirectURI %q is not a valid regexp expression", uri)
+					}
+				}
+			}
 			logger.Info("config static client", "client_name", client.Name)
 		}
 		s = storage.WithStaticClients(s, c.StaticClients)

server/authflow/request.go

@@ -7,6 +7,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"regexp"
 	"slices"
 	"strconv"
 	"strings"
@@ -93,6 +94,16 @@ func validateRedirectURI(client storage.Client, redirectURI string) bool {
 			return true
 		}
 	}
+
+	// Check redirectURIs using regexp package if is allowed
+	if client.InsecureAllowRegexpRedirectURIs {
+		valid := validateRegexpRedirectURI(client.RedirectURIs, redirectURI, client.InsecureAllowWildcardRedirectURIs)
+
+		if valid {
+			return true
+		}
+	}
+
 	// For non-public clients or when RedirectURIs is set, we allow only explicitly named RedirectURIs.
 	if !client.Public || len(client.RedirectURIs) > 0 {
 		return false
@@ -126,6 +137,25 @@ func isHostLocal(host string) bool {
 	return host == "localhost" || net.ParseIP(host).IsLoopback()
 }
 
+func validateRegexpRedirectURI(redirectURIs []string, redirectURI string, allowWildcard bool) bool {
+	for _, uri := range redirectURIs {
+		if !allowWildcard && strings.Contains(uri, ".*") {
+			continue
+		}
+
+		rgx, err := regexp.Compile(uri)
+		if err != nil {
+			continue
+		}
+
+		if rgx.Match([]byte(redirectURI)) {
+			return true
+		}
+	}
+
+	return false
+}
+
 func validateConnectorID(connectors []storage.Connector, connectorID string) bool {
 	for _, c := range connectors {
 		if c.ID == connectorID {

server/authflow/request_test.go

@@ -169,6 +169,77 @@ func TestParseAuthorizationRequest(t *testing.T) {
 				"scope":         "openid email profile",
 			},
 		},
+		{
+			name: "regexp url",
+			clients: []storage.Client{
+				{
+					ID:                              "bar",
+					InsecureAllowRegexpRedirectURIs: true,
+					RedirectURIs:                    []string{`https://pr-(\d+).example.com`},
+				},
+			},
+			supportedResponseTypes: []string{"code", "id_token", "token"},
+			queryParams: map[string]string{
+				"client_id":     "bar",
+				"redirect_uri":  "https://pr-1010.example.com",
+				"response_type": "code",
+				"scope":         "openid email profile",
+			},
+		},
+		{
+			name: "regexp url without flag",
+			clients: []storage.Client{
+				{
+					ID:                              "bar",
+					InsecureAllowRegexpRedirectURIs: false,
+					RedirectURIs:                    []string{`https://pr-(\d+).example.com`},
+				},
+			},
+			supportedResponseTypes: []string{"code", "id_token", "token"},
+			queryParams: map[string]string{
+				"client_id":     "bar",
+				"redirect_uri":  "https://pr-1010.example.com",
+				"response_type": "code",
+				"scope":         "openid email profile",
+			},
+			expectedError: &displayedAuthErr{Status: http.StatusBadRequest},
+		},
+		{
+			name: "wildcard url",
+			clients: []storage.Client{
+				{
+					ID:                                "bar",
+					InsecureAllowRegexpRedirectURIs:   true,
+					InsecureAllowWildcardRedirectURIs: true,
+					RedirectURIs:                      []string{`https?://.*`},
+				},
+			},
+			supportedResponseTypes: []string{"code", "id_token", "token"},
+			queryParams: map[string]string{
+				"client_id":     "bar",
+				"redirect_uri":  "https://example.com",
+				"response_type": "code",
+				"scope":         "openid email profile",
+			},
+		},
+		{
+			name: "wildcard url without flag",
+			clients: []storage.Client{
+				{
+					ID:                              "bar",
+					InsecureAllowRegexpRedirectURIs: true,
+					RedirectURIs:                    []string{`https?://.*`},
+				},
+			},
+			supportedResponseTypes: []string{"code", "id_token", "token"},
+			queryParams: map[string]string{
+				"client_id":     "bar",
+				"redirect_uri":  "https://example.com",
+				"response_type": "code",
+				"scope":         "openid email profile",
+			},
+			expectedError: &displayedAuthErr{Status: http.StatusBadRequest},
+		},
 		{
 			name: "choose second connector_id",
 			clients: []storage.Client{

storage/storage.go

@@ -166,6 +166,17 @@ type Client struct {
 	Secret    string `json:"secret"`
 	SecretEnv string `json:"secretEnv"`
 
+	// InsecureAllowRegexpRedirectURIs is an additiona flag allowing, add to
+	// RedirectURIs regexp expressions for dynamic URIs.
+	//
+	// Note: The flag does not allow wildcard regexp like: ".*" or "https?://.*" or
+	// any ".*" in the string, unless using InsecureAllowWildcardRedirectURIs flag.
+	InsecureAllowRegexpRedirectURIs bool `json:"insecureAllowRegexpRedirectURIs"`
+
+	// InsecureAllowWildcardRedirectURIs in use with InsecureAllowRegexpRedirectURIs
+	// allows to add wildcard regexp mainly for development purpose.
+	InsecureAllowWildcardRedirectURIs bool `json:"insecureAllowWildcardRedirectURIs"`
+
 	// A registered set of redirect URIs. When redirecting from dex to the client, the URI
 	// requested to redirect to MUST match one of these values, unless the client is "public".
 	RedirectURIs []string `json:"redirectURIs"`