From 3ea8c6271fa615cd8125e30ac4d843052d3b7865 Mon Sep 17 00:00:00 2001 From: Leo Adamek Date: Tue, 10 Feb 2026 13:06:21 +0000 Subject: [PATCH] fix: Update redirect URI checks to use `REQUEST_URI` only Fixes issues on runtimes which don't set `SERVER_NAME`, relies now only on `REQUEST_URI` --- src/LogtoClient.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/LogtoClient.php b/src/LogtoClient.php index 615545e..a61cd4f 100644 --- a/src/LogtoClient.php +++ b/src/LogtoClient.php @@ -298,9 +298,9 @@ public function handleSignInCallback(): void throw new LogtoException('Sign-in session not found.'); } - // Some loose checks + // Some loose checks: ensure the host and path of the current request URL matches what was set when initiating the sign-in. if ( - parse_url($signInSession->redirectUri, PHP_URL_HOST) !== ($_SERVER['SERVER_NAME'] ?? null) || + parse_url($signInSession->redirectUri, PHP_URL_HOST) !== parse_url($_SERVER['REQUEST_URI'], PHP_URL_HOST) || parse_url($signInSession->redirectUri, PHP_URL_PATH) !== parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH) ) { throw new LogtoException('The redirect URI in the sign-in session does not match the current request.');