v0.0.54 - Fix SSRF false positive for own issuer

melvincarvalho · melvincarvalho · commit 02095ba6512b · 2026-01-03T21:43:23.000+01:00
When the server validates tokens from its own IdP, the SSRF check
was blocking because the hostname resolves to localhost internally.

Added trusted issuer whitelist - the server's own issuer is now
automatically trusted when the IdP plugin initializes.
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "javascript-solid-server",
-  "version": "0.0.53",
+  "version": "0.0.54",
   "description": "A minimal, fast Solid server",
   "main": "src/index.js",
   "type": "module",
diff --git a/src/auth/solid-oidc.js b/src/auth/solid-oidc.js
@@ -20,6 +20,19 @@ const jwksCache = new Map();
 // Cache TTL (15 minutes)
 const CACHE_TTL = 15 * 60 * 1000;
 
+// Trusted issuers (skip SSRF check) - populated by server config
+const trustedIssuers = new Set();
+
+/**
+ * Add a trusted issuer (e.g., the server's own issuer)
+ * Trusted issuers bypass SSRF validation since they're configured by admin
+ */
+export function addTrustedIssuer(issuer) {
+  const normalized = issuer.replace(/\/$/, '');
+  trustedIssuers.add(normalized);
+  trustedIssuers.add(normalized + '/');
+}
+
 // DPoP proof max age (5 minutes)
 const DPOP_MAX_AGE = 5 * 60;
 
@@ -206,15 +219,21 @@ async function getOidcConfig(issuer) {
     return cached.config;
   }
 
-  // SSRF Protection: Validate issuer URL before fetching
-  const validation = await validateExternalUrl(issuer, {
-    requireHttps: true,
-    blockPrivateIPs: true,
-    resolveDNS: true
-  });
+  // Check if this is a trusted issuer (e.g., our own server)
+  const normalizedIssuer = issuer.replace(/\/$/, '');
+  const isTrusted = trustedIssuers.has(normalizedIssuer) || trustedIssuers.has(normalizedIssuer + '/');
+
+  // SSRF Protection: Validate issuer URL before fetching (skip for trusted issuers)
+  if (!isTrusted) {
+    const validation = await validateExternalUrl(issuer, {
+      requireHttps: true,
+      blockPrivateIPs: true,
+      resolveDNS: true
+    });
 
-  if (!validation.valid) {
-    throw new Error(`Invalid OIDC issuer: ${validation.error}`);
+    if (!validation.valid) {
+      throw new Error(`Invalid OIDC issuer: ${validation.error}`);
+    }
   }
 
   const configUrl = `${issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
diff --git a/src/idp/index.js b/src/idp/index.js
@@ -18,6 +18,7 @@ import {
   handleCredentials,
   handleCredentialsInfo,
 } from './credentials.js';
+import { addTrustedIssuer } from '../auth/solid-oidc.js';
 
 /**
  * IdP Fastify Plugin
@@ -32,6 +33,9 @@ export async function idpPlugin(fastify, options) {
     throw new Error('IdP requires issuer URL');
   }
 
+  // Register our own issuer as trusted (bypasses SSRF check for self-validation)
+  addTrustedIssuer(issuer);
+
   // Initialize signing keys
   await initializeKeys();
 

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "javascript-solid-server",`
`3`		`- "version": "0.0.53",`
	`3`	`+ "version": "0.0.54",`
`4`	`4`	`"description": "A minimal, fast Solid server",`
`5`	`5`	`"main": "src/index.js",`
`6`	`6`	`"type": "module",`