security: fix OIDC state check bypass + open redirect in login-token

- oidc.js: remove || true — state check now works in all environments - auth.js: wrap returnTo in safeReturn (was unprotected on line 166)
2026-06-11 20:02:49 +04:00
parent 351cb6afe6
commit 1350f0dbba
4 changed files with 604 additions and 4 deletions
@@ -163,7 +163,7 @@ function createRouter({ auth, MOCK_USERS, authLimiter }) {
      companyName:    activeClientId,
      isAdmin:        activeClientId === (process.env.ADMIN_CLIENT_ID || 'WZ01112'),
    };
-    res.redirect(returnTo || '/');
+    res.redirect(safeReturn(returnTo) || '/');
  });

  // ── Переключатель режима администратора ──────────────────────────────