From d3e8845fac23b97eb74b9957acd07fed46535f06 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aur=C3=A9lien=20Sibiril?=
 <81782+aureliensibiril@users.noreply.github.com>
Date: Thu, 4 Jun 2026 18:29:11 +0200
Subject: [PATCH] Pin Okta pagination to the same https origin
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The rel="next" link is taken from the provider response, so the host
check alone let a response downgrade the next request to http or move
it to another port on the same host. Reject a non-https scheme and any
explicit port in addition to a host mismatch, so the crawl stays on
the same https origin.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>
---
 pkg/accessreview/drivers/okta.go | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkg/accessreview/drivers/okta.go b/pkg/accessreview/drivers/okta.go
index 42fd7c74a..676edd2aa 100644
--- a/pkg/accessreview/drivers/okta.go
+++ b/pkg/accessreview/drivers/okta.go
@@ -178,8 +178,11 @@ func (d *OktaDriver) nextPageURL(linkHeader string) (string, error) {
 		return "", fmt.Errorf("cannot parse okta next-page link")
 	}
 
-	if !strings.EqualFold(u.Hostname(), d.domain) {
-		return "", fmt.Errorf("cannot follow okta next-page link: host mismatch")
+	// Pin the next page to the same https origin: reject a scheme downgrade
+	// (http), an explicit port, or a different host so a provider response
+	// cannot redirect the crawl off-TLS, to another port, or off-tenant.
+	if !strings.EqualFold(u.Scheme, "https") || u.Port() != "" || !strings.EqualFold(u.Hostname(), d.domain) {
+		return "", fmt.Errorf("cannot follow okta next-page link: invalid target")
 	}
 
 	return u.String(), nil