From 684fbc089ea337371d9ccff06b95de985bfb8835 Mon Sep 17 00:00:00 2001
From: xavi <114113189+volcanonoodle@users.noreply.github.com>
Date: Fri, 11 Apr 2025 14:00:33 +0200
Subject: [PATCH] [release-11.5.4] [IAM] Prepend AppSubURL to redirectURI
 before validating it (#103771)

[IAM] Prepend AppSubURL to redirectURI before validating it (#103475)

(cherry picked from commit 5053aa576d521b81ad561ccd0ef9f2c4d5fffe1a)
---
 pkg/api/user_token.go       | 4 ++--
 pkg/services/authn/authn.go | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkg/api/user_token.go b/pkg/api/user_token.go
index 7770fee84ea..0e278baf519 100644
--- a/pkg/api/user_token.go
+++ b/pkg/api/user_token.go
@@ -89,11 +89,11 @@ func (hs *HTTPServer) RotateUserAuthTokenRedirect(c *contextmodel.ReqContext) re
 		return response.Redirect(hs.GetRedirectURL(c))
 	}
 
-	redirectTo := c.Query("redirectTo")
+	redirectTo := hs.Cfg.AppSubURL + c.Query("redirectTo")
 	if err := hs.ValidateRedirectTo(redirectTo); err != nil {
 		return response.Redirect(hs.Cfg.AppSubURL + "/")
 	}
-	return response.Redirect(hs.Cfg.AppSubURL + redirectTo)
+	return response.Redirect(redirectTo)
 }
 
 // swagger:route POST /user/auth-tokens/rotate
diff --git a/pkg/services/authn/authn.go b/pkg/services/authn/authn.go
index e5efc86b749..15227c8e333 100644
--- a/pkg/services/authn/authn.go
+++ b/pkg/services/authn/authn.go
@@ -283,7 +283,7 @@ func handleLogin(r *http.Request, w http.ResponseWriter, cfg *setting.Cfg, ident
 			scopedRedirectToCookie, err := r.Cookie(redirectToCookieName)
 			if err == nil {
 				redirectTo, _ := url.QueryUnescape(scopedRedirectToCookie.Value)
-				if redirectTo != "" && validator(redirectTo) == nil {
+				if redirectTo != "" && validator(cfg.AppSubURL+redirectTo) == nil {
 					redirectURL = cfg.AppSubURL + redirectTo
 				}
 				cookies.DeleteCookie(w, redirectToCookieName, cookieOptions(cfg))