Fix wildcard redirect URI validation for Netlify double-dash deploy previews - #1750
Merged
dopry merged 3 commits intoJul 23, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes validation of wildcard redirect_uris that target Netlify deploy preview hostnames using a double dash (e.g. https://*--sitename.netlify.app), aligning form/admin validation with runtime wildcard support.
Changes:
- Update
AllowedURIValidatorto strip all leading hyphens after removing a leading hostname*wildcard (fixing*--...cases). - Add unit test coverage for the Netlify double-dash wildcard hostname pattern.
- Document the fix in
CHANGELOG.mdand add the author toAUTHORS.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| oauth2_provider/validators.py | Adjusts wildcard-hostname normalization to handle multiple leading hyphens after *. |
| tests/test_validators.py | Adds a regression test for Netlify deploy-preview double-dash wildcard redirect URIs. |
| CHANGELOG.md | Notes the Netlify wildcard redirect URI validation fix under “Fixed”. |
| AUTHORS | Adds the contributor name. |
dopry
requested changes
Jul 9, 2026
dopry
left a comment
Member
There was a problem hiding this comment.
@apoorvdarshan thanks for this looks great. A few items to address,
- Add runtime-matching tests in tests/test_models.py, not just the validator test:
# valid_wildcard_redirect_to_params (line 1103)
("https://deploy-preview-42--sitename.netlify.app", ["https://*--sitename.netlify.app"]),
# invalid_wildcard_redirect_to_params (line 1117)
("https://x-sitename.netlify.app", ["https://*--sitename.netlify.app"]),
("https://evil--othersite.netlify.app", ["https://*--sitename.netlify.app"]),
- Document the double-dash form in docs/settings.rst (ALLOW_URI_WILDCARDS, lines 76–84): add https://*--sitename.netlify.app as allowed, and note single-dash *-sitename.netlify.app is unsafe.
- lstrip("-") also accepts *---slug…; slightly broader than the comment's "double dash",
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Member
|
@apoorvdarshan do you have time to follow up and complete this PR? |
Netlify deploy-preview redirect URIs use a double dash, e.g. https://*--sitename.netlify.app (matching deploy-preview-42--sitename. netlify.app). After removing the '*' wildcard the validator stripped only a single leading hyphen, leaving a hostname starting with '-' that Django's URIValidator rejects. Strip all leading hyphens so these hosts validate, and add a regression test. Fixes django-oauth#1619.
dopry
force-pushed
the
fix-1619-netlify-wildcard-double-dash
branch
from
July 23, 2026 22:29
2504799 to
d3f5f88
Compare
The settings docs listed https://*.sub.example.com as "not allowed", but the validator accepts it (wildcard at the start, extra subdomain label, SLD/TLD intact) — consistent with the stated rule that the wildcard only cannot be in the top or second level domain. Flip the example to allowed and keep the two genuinely-rejected examples (*.com, example.*.com). Addresses Copilot review comment r3641805539. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_01Y2KLHQubcBjXwc39fbgL8S
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
oauth2_provider/validators.py:121
- The PR description still states the fix is
netloc = netloc.lstrip("-")/ “strip all leading hyphens”, but the implementation intentionally strips up to two leading hyphens (rejecting longer runs like*---..., which is also now covered by a test). Please update the PR body’s “Fix” section to match the actual behavior/guarantees so future reviewers aren’t misled.
# Domains cannot start with a hyphen, but can have them in the middle, so strip up to two
# hyphens after the wildcard. This supports Netlify deploy previews
# (e.g. *--sitename.netlify.app) while leaving longer runs for URIValidator to reject.
if netloc.startswith("--"):
netloc = netloc[2:]
elif netloc.startswith("-"):
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1619.
Description of the Change
Wildcard
redirect_urisfor Netlify deploy previews were rejected by the application form / admin validator, even though the underlying authorization flow accepts them at runtime.Netlify deploy-preview hostnames use a double dash, e.g.
deploy-preview-42--sitename.netlify.appor1234abcd--sitename.netlify.app. The natural wildcard for these ishttps://*--sitename.netlify.app. (As the reporter notes, a single-dash pattern likehttps://*-sitename.netlify.appwould be too broad and could match unrelatedsomething-sitename.netlify.apphosts, so the double dash is the correct, safe pattern.)In
oauth2_provider/validators.py, after stripping the leading*, the validator stripped only one leading hyphen:For
*--sitename.netlify.appthis leaves-sitename.netlify.app, which begins with a hyphen and is rejected by Django'sURIValidator("Enter a valid URL."). This made the affectedApplicationun-editable in the Django admin, since every save failed validation.Fix
Strip all leading hyphens after the wildcard:
This accepts the double-dash Netlify form while leaving all previously-valid patterns unchanged. It does not over-broaden validation: bare wildcards, TLD/SLD-only wildcards (
*.com,*-partial.com), all-hyphen labels (*--.com), multiple wildcards, and non-leading wildcards are all still rejected downstream byURIValidator, because only the leading hyphens (not the required domain labels) are removed.Tests
Added
https://*--sitename.netlify.appto thegood_urislist intests/test_validators.py::TestAllowedURIValidator::test_allow_hostname_wildcard. The test fails onmaster(the URI is rejected) and passes with the fix. The existing bad-URI assertions continue to pass, confirming no regression in what the validator rejects.CHANGELOG.mdupdatedAUTHORSDisclosure: prepared with AI assistance; reviewed and verified locally.