FAPI 2.0 requires 303 redirects and it will increase security in all implementations. Should we simply change RedirectToAbsoluteUrl to always use 303 redriect (or should it be configurable)? I can implement this.
- Change EndSessionResult.ExecuteAsync to use RedirectToAbsoluteUrl
- Change AuthorizeResult.RenderAuthorizeResponseAsync to use RedirectToAbsoluteUrl
Update the uri += "#_=_" in AuthorizeResult,.BuildRedirectUri (from https://tools.ietf.org/html/draft-bradley-oauth-open-redirector-00) to uri += "#_" as suggested in the final spec https://datatracker.ietf.org/doc/html/rfc9700#name-countermeasures
FAPI 2.0 requires 303 redirects and it will increase security in all implementations. Should we simply change RedirectToAbsoluteUrl to always use 303 redriect (or should it be configurable)? I can implement this.
Update the uri += "#_=_" in AuthorizeResult,.BuildRedirectUri (from https://tools.ietf.org/html/draft-bradley-oauth-open-redirector-00) to uri += "#_" as suggested in the final spec https://datatracker.ietf.org/doc/html/rfc9700#name-countermeasures