Fixed handling of invalid URLs in the addRequestedHeaders function (#20)

rorylshanks · Mar 15, 2024 · a426910 · a426910
1 parent 8c93acb
commit a426910
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/lib/authz.js b/lib/authz.js
@@ -39,7 +39,9 @@ async function checkUserGroupMembership(user, groups) {
 async function addRequestedHeaders(req, res, route, user, discoveredGroups) {
     var proxyTo = {}
     try {
-        proxyTo = new URL(route.to.url || route.to.name || route.to)
+        var rawURL = route.to.url || route.to.name || route.to
+        var urlWithPrefix = rawURL.startsWith("http") ? rawURL : `http://${rawURL}`
+        proxyTo = new URL(urlWithPrefix)
     } catch (error) {
         log.warn({ message: "Unable to get audience from route", context: { error: error.message, stack: error.stack, route: route } })
     }