Validate session transfer redirect with saferedirect

The session transfer handler was blindly redirecting to the continue URL
from the signed token. Use saferedirect with a trust center domain check
to prevent open redirects, and only trigger session transfer for known
trust center custom domains instead of any non-base-URL host.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/server/api/trust/v1/session_transfer_handler.go

@@ -22,6 +22,7 @@ import (
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
+	"go.probo.inc/probo/pkg/saferedirect"
 	"go.probo.inc/probo/pkg/securecookie"
 	"go.probo.inc/probo/pkg/server/api/authn"
 )
@@ -30,18 +31,21 @@ type SessionTransferHandler struct {
 	iam           *iam.Service
 	sessionCookie *authn.Cookie
 	cookieSecret  string
+	safeRedirect  *saferedirect.SafeRedirect
 	logger        *log.Logger
 }
 
 func NewSessionTransferHandler(
 	iamSvc *iam.Service,
 	cookieConfig securecookie.Config,
+	allowedHost saferedirect.AllowedHostFunc,
 	logger *log.Logger,
 ) *SessionTransferHandler {
 	return &SessionTransferHandler{
 		iam:           iamSvc,
 		sessionCookie: authn.NewCookie(&cookieConfig),
 		cookieSecret:  cookieConfig.Secret,
+		safeRedirect:  saferedirect.New(allowedHost),
 		logger:        logger,
 	}
 }
@@ -82,5 +86,5 @@ func (h *SessionTransferHandler) ServeHTTP(w http.ResponseWriter, r *http.Reques
 
 	h.sessionCookie.Set(w, session)
 
-	http.Redirect(w, r, continueURL, http.StatusFound)
+	h.safeRedirect.Redirect(w, r, continueURL, "/", http.StatusFound)
 }