[MEDIUM] security: block redirects carrying custom headers

.changeset/brave-owls-redirect.md

@@ -0,0 +1,5 @@
+---
+"react-native-app-auth": patch
+---
+
+Stop native OAuth endpoint redirects when custom headers are present so credential-bearing headers cannot be forwarded to another origin.

docs/docs/usage/config.md

@@ -52,3 +52,7 @@ See specific example [configurations for your provider](/docs/category/providers
 - **androidAllowCustomBrowsers** - (`string[]`) (default: undefined) _ANDROID_ override the used browser for authorization. If no value is provided, all browsers are allowed.
 - **androidTrustedWebActivity** - (`boolean`) (default: `false`) _ANDROID_ Use [`EXTRA_LAUNCH_AS_TRUSTED_WEB_ACTIVITY`](https://developer.chrome.com/docs/android/trusted-web-activity/) when opening web view.
 - **connectionTimeoutSeconds** - (`number`) configure the request timeout interval in seconds. This must be a positive number. The default values are 60 seconds on iOS and 15 seconds on Android.
+
+Native discovery, token, and registration requests do not follow HTTP redirects when custom headers
+are present. Configure the final endpoint URL directly so credential-bearing headers cannot be
+forwarded to a redirected origin.

packages/react-native-app-auth/android/src/main/java/com/rnappauth/utils/CustomConnectionBuilder.java

@@ -57,7 +57,8 @@ public void setConnectionTimeout (int timeout) {
     public HttpURLConnection openConnection(@NonNull Uri uri) throws IOException {
         HttpURLConnection conn = connectionBuilder.openConnection(uri);
 
-        if (headers != null) {
+        if (headers != null && !headers.isEmpty()) {
+            conn.setInstanceFollowRedirects(false);
             for (Map.Entry<String, String> header: headers.entrySet()) {
                 conn.setRequestProperty(header.getKey(), header.getValue());
             }

packages/react-native-app-auth/ios/RNAppAuth.m

@@ -8,7 +8,7 @@
 #import <React/RCTConvert.h>
 #import "RNAppAuthAuthorizationFlowManager.h"
 
-@interface RNAppAuth()<RNAppAuthAuthorizationFlowManagerDelegate> {
+@interface RNAppAuth()<RNAppAuthAuthorizationFlowManagerDelegate, NSURLSessionTaskDelegate> {
     id<OIDExternalUserAgentSession> _currentSession;
 }
 @end
@@ -554,10 +554,21 @@ - (void)configureUrlSession: (NSDictionary*) headers sessionTimeout: (double) se
 
     configuration.timeoutIntervalForRequest = sessionTimeout;
 
-    NSURLSession* session = [NSURLSession sessionWithConfiguration:configuration];
+    NSURLSession* session = headers.count > 0
+        ? [NSURLSession sessionWithConfiguration:configuration delegate:self delegateQueue:nil]
+        : [NSURLSession sessionWithConfiguration:configuration];
     [OIDURLSessionProvider setSession:session];
 }
 
+- (void)URLSession:(NSURLSession *)session
+              task:(NSURLSessionTask *)task
+willPerformHTTPRedirection:(NSHTTPURLResponse *)response
+        newRequest:(NSURLRequest *)request
+ completionHandler:(void (^)(NSURLRequest *_Nullable))completionHandler
+{
+    completionHandler(nil);
+}
+
 /*
  * Take raw OIDAuthorizationResponse and turn it to response format to pass to JavaScript caller
  */