Request for enhancement

Parse Referer as a URL and validate scheme and host exactly (and optionally enforce that path begins with /ipa).

Issue

FreeIPA uses HTTP_Status.check_referer() as a CSRF/origin gate for multiple /ipa/session/* handlers. The check performs a naive string prefix match on HTTP_REFERER by way of startswith("https:///ipa") rather than parsing and validating the Referer URL. As a result, non-canonical Referer values beginning with the trusted prefix (e.g., https://idm1.lab.test/ipa@evil.test/) are accepted and the gate is bypassed.

Impact
The most directly affected handlers (/ipa/session/login_password, /ipa/session/change_password, /ipa/session/sync_token) are pre-auth and become reachable whenever a client can supply a Referer string that passes the naive prefix check. For authenticated session handlers, the gate can be satisfied by ambiguous/non-canonical Referer values; if a deployment relies on this gate as a CSRF/origin control in the presence of intermediaries (reverse proxies, WAFs) that merge/normalize headers, the protection is weakened and request interpretation becomes ambiguous.

Recommendations
Parse Referer as a URL and validate scheme and host exactly (and optionally enforce that path begins with /ipa).

Reject non-canonical Referer values (e.g., containing commas) and consider rejecting duplicate Referer headers where possible.

Consider augmenting Referer-based checks with per-request CSRF tokens for browser-session flows, where feasible.

Steps to Reproduce

Tested session handlers (server-side code paths in ipaserver/rpcserver.py):

/ipa/session/login_password, /ipa/session/change_password, /ipa/session/sync_token, /ipa/session/login_kerberos, /ipa/session/json (jsonserver_session), /ipa/session/xml (xmlserver_session), /ipa/session/cookie (called indirectly by login_kerberos).

Actual behavior

Non-canonical Referer values beginning with the trusted prefix (e.g., https://idm1.lab.test/ipa@evil.test/) are accepted and the gate is bypassed.

Expected behavior

Parse Referer as a URL and validate scheme and host exactly (and optionally enforce that path begins with /ipa).

Reject non-canonical Referer values (e.g., containing commas) and consider rejecting duplicate Referer headers where possible.

Additional info:

References
CWE-346 (Origin Validation Error)
CWE-20: Improper Input Validation
CWE-352: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery Prevention - OWASP Cheat Sheet Series