diff --git a/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Authentication.cs b/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Authentication.cs index 637501c0..1aa101bf 100644 --- a/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Authentication.cs +++ b/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Authentication.cs @@ -187,6 +187,11 @@ public static partial class OpenIddictServerAspNetCoreHandlers throw new ArgumentNullException(nameof(context)); } + if (context is not { BaseUri.IsAbsoluteUri: true, RequestUri.IsAbsoluteUri: true }) + { + throw new InvalidOperationException(SR.GetResourceString(SR.ID0127)); + } + Debug.Assert(context.Request is not null, SR.GetResourceString(SR.ID4008)); // This handler only applies to ASP.NET Core requests. If the HTTP context cannot be resolved, @@ -246,7 +251,7 @@ public static partial class OpenIddictServerAspNetCoreHandlers // Create a new GET authorization request containing only the request_id parameter. var location = QueryHelpers.AddQueryString( - uri: request.Scheme + Uri.SchemeDelimiter + request.Host + request.PathBase + request.Path, + uri: new UriBuilder(context.RequestUri) { Query = null }.Uri.AbsoluteUri, name: Parameters.RequestId, value: context.Request.RequestId); diff --git a/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Session.cs b/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Session.cs index 0b2ed3f8..4a5b7a64 100644 --- a/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Session.cs +++ b/src/OpenIddict.Server.AspNetCore/OpenIddictServerAspNetCoreHandlers.Session.cs @@ -184,6 +184,11 @@ public static partial class OpenIddictServerAspNetCoreHandlers throw new ArgumentNullException(nameof(context)); } + if (context is not { BaseUri.IsAbsoluteUri: true, RequestUri.IsAbsoluteUri: true }) + { + throw new InvalidOperationException(SR.GetResourceString(SR.ID0127)); + } + Debug.Assert(context.Request is not null, SR.GetResourceString(SR.ID4008)); // This handler only applies to ASP.NET Core requests. If the HTTP context cannot be resolved, @@ -243,7 +248,7 @@ public static partial class OpenIddictServerAspNetCoreHandlers // Create a new GET logout request containing only the request_id parameter. var location = QueryHelpers.AddQueryString( - uri: request.Scheme + Uri.SchemeDelimiter + request.Host + request.PathBase + request.Path, + uri: new UriBuilder(context.RequestUri) { Query = null }.Uri.AbsoluteUri, name: Parameters.RequestId, value: context.Request.RequestId); diff --git a/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Authentication.cs b/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Authentication.cs index 7b770e9c..eec88ada 100644 --- a/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Authentication.cs +++ b/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Authentication.cs @@ -186,6 +186,11 @@ public static partial class OpenIddictServerOwinHandlers throw new ArgumentNullException(nameof(context)); } + if (context is not { BaseUri.IsAbsoluteUri: true, RequestUri.IsAbsoluteUri: true }) + { + throw new InvalidOperationException(SR.GetResourceString(SR.ID0127)); + } + Debug.Assert(context.Request is not null, SR.GetResourceString(SR.ID4008)); // This handler only applies to OWIN requests. If The OWIN request cannot be resolved, @@ -242,7 +247,7 @@ public static partial class OpenIddictServerOwinHandlers // Create a new GET authorization request containing only the request_id parameter. var location = WebUtilities.AddQueryString( - uri: request.Scheme + Uri.SchemeDelimiter + request.Host + request.PathBase + request.Path, + uri: new UriBuilder(context.RequestUri) { Query = null }.Uri.AbsoluteUri, name: Parameters.RequestId, value: context.Request.RequestId); diff --git a/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Session.cs b/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Session.cs index 4f85c1ea..4a1cf06e 100644 --- a/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Session.cs +++ b/src/OpenIddict.Server.Owin/OpenIddictServerOwinHandlers.Session.cs @@ -184,6 +184,11 @@ public static partial class OpenIddictServerOwinHandlers throw new ArgumentNullException(nameof(context)); } + if (context is not { BaseUri.IsAbsoluteUri: true, RequestUri.IsAbsoluteUri: true }) + { + throw new InvalidOperationException(SR.GetResourceString(SR.ID0127)); + } + Debug.Assert(context.Request is not null, SR.GetResourceString(SR.ID4008)); // This handler only applies to OWIN requests. If The OWIN request cannot be resolved, @@ -240,7 +245,7 @@ public static partial class OpenIddictServerOwinHandlers // Create a new GET logout request containing only the request_id parameter. var location = WebUtilities.AddQueryString( - uri: request.Scheme + Uri.SchemeDelimiter + request.Host + request.PathBase + request.Path, + uri: new UriBuilder(context.RequestUri) { Query = null }.Uri.AbsoluteUri, name: Parameters.RequestId, value: context.Request.RequestId);