fix(oidc): trusted clients need trusted redirect URIs

Author: azmeuk

CHANGES.rst

@@ -27,6 +27,9 @@ Fixed
 - Request objects and client key sets, downloaded at the ``request_uri`` and
   ``jwks_uri`` addresses clients indicate, were read in memory without any size
   limit. They are now bounded to 64kB.
+- Trusted clients, which skip the user consent page, need both their
+  ``client_uri`` and their ``redirect_uris`` to match
+  :attr:`~canaille.oidc.configuration.OIDCSettings.TRUSTED_DOMAINS`.
 
 [0.3.6] - 2026-08-04
 --------------------

canaille/oidc/basemodels.py

@@ -6,7 +6,7 @@
 
 from canaille.backends.models import Model
 from canaille.core.models import User
-from canaille.oidc.utils import is_trusted_domain
+from canaille.oidc.utils import is_trusted_client
 
 
 class Client(Model):
@@ -24,13 +24,12 @@ class Client(Model):
     def trusted(self) -> bool:
         """Trusted clients don't require to display the consent page to users.
 
-        A client is trusted if its client_uri domain matches one of the domains
-        listed in TRUSTED_DOMAINS configuration. Supports:
-        - Exact match: "example.com" matches "example.com"
-        - Subdomain match: "example.com" also matches "sub.example.com"
-        - Wildcard match: ".example.com" matches "example.com" and all its subdomains
+        A client is trusted when its :attr:`client_uri` **and** all its
+        :attr:`redirect_uris` match the domains listed in the
+        :attr:`~canaille.oidc.configuration.OIDCSettings.TRUSTED_DOMAINS`
+        configuration parameter, that documents the supported patterns.
         """
-        return is_trusted_domain(self.client_uri)
+        return is_trusted_client(self.client_uri, self.redirect_uris)
 
     # keep 'List' instead of 'list' do not break py310 with the memory backend
     audience: List["Client"] = []  # noqa: UP006

canaille/oidc/utils.py

@@ -75,3 +75,15 @@ def is_trusted_domain(domain):
             return True
 
     return False
+
+
+def is_trusted_client(client_uri: str | None, redirect_uris: list[str] | None) -> bool:
+    """Whether a client with those URIs is trusted enough to skip the consent page.
+
+    The redirect URIs are checked in addition to the client URI, as the client
+    URI is a purely declarative value that is never fetched: trusting it alone
+    would let a client have authorization codes delivered to any address.
+    """
+    return is_trusted_domain(client_uri) and all(
+        is_trusted_domain(redirect_uri) for redirect_uri in redirect_uris or []
+    )

tests/oidc/test_authorization_code_flow.py

@@ -293,6 +293,7 @@ def test_trusted_client(testclient, logged_user, client, trusted_client, backend
     assert not backend.query(models.Consent, client=client, subject=logged_user)
 
     client.client_uri = "https://client.trusted.test"
+    client.redirect_uris = ["https://client.trusted.test/redirect1"]
     backend.save(client)
 
     res = testclient.get(
@@ -302,7 +303,7 @@ def test_trusted_client(testclient, logged_user, client, trusted_client, backend
             client_id=client.client_id,
             scope="openid profile",
             nonce="somenonce",
-            redirect_uri="https://client.test/redirect1",
+            redirect_uri=client.redirect_uris[0],
         ),
         status=302,
     )

tests/oidc/test_client_admin.py

@@ -248,6 +248,12 @@ def test_client_edit_preauth(testclient, client, logged_admin, trusted_client, b
 
     res = testclient.get("/admin/client/edit/" + client.client_id)
     res.forms["clienteditform"]["client_uri"] = "https://client.trusted.test"
+    res.forms["clienteditform"]["redirect_uris-0"] = (
+        "https://client.trusted.test/redirect1"
+    )
+    res.forms["clienteditform"]["redirect_uris-1"] = (
+        "https://client.trusted.test/redirect2"
+    )
     res = res.forms["clienteditform"].submit(name="action", value="edit")
 
     assert ("success", "The client has been edited.") in res.flashes
@@ -263,6 +269,26 @@ def test_client_edit_preauth(testclient, client, logged_admin, trusted_client, b
     assert not client.trusted
 
 
+def test_client_edit_preauth_needs_trusted_redirect_uris(
+    testclient, client, logged_admin, trusted_client, backend
+):
+    """A trusted client_uri is not enough: the redirect URIs are where codes are sent."""
+    res = testclient.get("/admin/client/edit/" + client.client_id)
+    res.forms["clienteditform"]["client_uri"] = "https://client.trusted.test"
+    res.forms["clienteditform"]["redirect_uris-0"] = (
+        "https://client.trusted.test/redirect1"
+    )
+    res = res.forms["clienteditform"].submit(name="action", value="edit")
+
+    assert ("success", "The client has been edited.") in res.flashes
+    backend.reload(client)
+    assert client.redirect_uris == [
+        "https://client.trusted.test/redirect1",
+        "https://client.test/redirect2",
+    ]
+    assert not client.trusted
+
+
 def test_client_edit_invalid_uri(testclient, client, logged_admin, trusted_client):
     res = testclient.get("/admin/client/edit/" + client.client_id)
     res.forms["clienteditform"]["client_uri"] = "invalid"

tests/oidc/test_consent.py

@@ -165,6 +165,7 @@ def test_trusted_client_appears_in_consent_list(
     res.mustcontain(no=client.client_name)
 
     client.client_uri = "https://client.trusted.test"
+    client.redirect_uris = ["https://client.trusted.test/redirect1"]
     backend.save(client)
 
     res = testclient.get("/consent/trusted-applications")
@@ -174,6 +175,7 @@ def test_trusted_client_appears_in_consent_list(
 def test_revoke_trusted_client(testclient, client, logged_user, token, backend):
     """Test that revoking a trusted client creates a revoked consent entry."""
     client.client_uri = "https://client.trusted.test"
+    client.redirect_uris = ["https://client.trusted.test/redirect1"]
     backend.save(client)
     assert not backend.get(models.Consent, client=client, subject=logged_user)
     assert not token.revoked
@@ -214,6 +216,7 @@ def test_revoke_trusted_client_with_manual_consent(
 ):
     """Test that revoking a trusted client with existing manual consent works correctly."""
     client.client_uri = "https://client.trusted.test"
+    client.redirect_uris = ["https://client.trusted.test/redirect1"]
     backend.save(client)
     res = testclient.get(f"/consent/revoke-trusted/{client.client_id}", status=302)
     res = res.follow()
@@ -225,6 +228,7 @@ def test_revoke_trusted_client_with_manual_revokation(
 ):
     """Test that revoking an already revoked trusted client displays an error."""
     client.client_uri = "https://client.trusted.test"
+    client.redirect_uris = ["https://client.trusted.test/redirect1"]
     backend.save(client)
     consent.revoke()
     backend.save(consent)

tests/oidc/test_jwt_authorization_grant.py

@@ -10,6 +10,7 @@ def test_nominal_case(testclient, logged_user, client, backend, server_jwk):
     """Test JWT grant for a client with consent."""
     now = time.time()
     client.client_uri = "https://client.trusted.test"
+    client.redirect_uris = ["https://client.trusted.test/redirect1"]
     backend.save(client)
 
     header = {"alg": "RS256"}

tests/oidc/test_trusted_domains.py

@@ -46,6 +46,28 @@ def test_trusted_domains_property(testclient, backend):
     assert not client_no_uri.trusted
 
 
+def test_trusted_domains_check_the_redirect_uris(testclient, backend):
+    """A trusted client_uri is not enough, as it is purely declarative.
+
+    The redirect URIs are the addresses authorization codes are actually sent to.
+    """
+    client = models.Client(
+        client_id="mixed-uris-client",
+        client_name="Mixed URIs Client",
+        client_uri="https://client.trusted.test",
+        redirect_uris=["https://client.trusted.test/redirect1"],
+    )
+    backend.save(client)
+    assert client.trusted
+
+    client.redirect_uris = [
+        "https://client.trusted.test/redirect1",
+        "https://evil.example.com/callback",
+    ]
+    backend.save(client)
+    assert not client.trusted
+
+
 def test_trusted_domains_consent_bypass(testclient, logged_user, backend):
     """Test that trusted clients bypass the consent page."""
     client = models.Client(