Validate session transfer redirect with saferedirect

The session transfer handler was blindly redirecting to the continue URL
from the signed token. Use saferedirect with a trust center domain check
to prevent open redirects, and only trigger session transfer for known
trust center custom domains instead of any non-base-URL host.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/trust/v1/resolver.go

@@ -32,6 +32,7 @@ package trust_v1
 
 import (
 	"context"
+	"net/http"
 	"time"
 
 	"github.com/go-chi/chi/v5"
@@ -84,8 +85,16 @@ func NewMux(
 
 	r.Use(compliancepage.NewCompliancePagePresenceMiddleware())
 
-	sessionTransferHandler := NewSessionTransferHandler(iamSvc, cookieConfig, logger)
-	r.Get("/session-transfer", sessionTransferHandler.ServeHTTP)
+	sessionTransferHandler := NewSessionTransferHandler(
+		iamSvc,
+		cookieConfig,
+		func(ctx context.Context, host string) bool {
+			_, err := trustSvc.GetByDomainName(ctx, host)
+			return err == nil
+		},
+		logger,
+	)
+	r.Method(http.MethodGet, "/session-transfer", sessionTransferHandler)
 
 	r.Use(authn.NewSessionMiddleware(iamSvc, cookieConfig))
 	r.Use(compliancepage.NewMemberProvisioningMiddleware(trustSvc, logger))