fix: validate OAuth callback origin against SCM provider domain

Update NonceService.validateOrigin to check request origin against the
expected SCM provider domain instead of Gitpod's own domain. This fixes
the CSRF protection logic for OAuth callbacks which legitimately come
from external providers (github.com, gitlab.com, etc.).

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

Author: iQQBot

components/server/src/auth/authenticator.ts

@@ -191,11 +191,12 @@ export class Authenticator {
                     }
 
                     // Validate origin for additional CSRF protection
-                    if (!this.nonceService.validateOrigin(req)) {
+                    if (!this.nonceService.validateOrigin(req, host)) {
                         log.error(`CSRF protection: Origin validation failed`, {
                             url: req.url,
                             origin: req.get("Origin"),
                             referer: req.get("Referer"),
+                            expectedHost: host,
                         });
                         res.status(403).send("Invalid request");
                         return;

components/server/src/auth/nonce-service.spec.ts

@@ -6,6 +6,7 @@
 
 import { expect } from "chai";
 import { Container } from "inversify";
+import express from "express";
 import { Config } from "../config";
 import { NonceService } from "./nonce-service";
 
@@ -66,15 +67,15 @@ describe("NonceService", () => {
     });
 
     describe("validateOrigin", () => {
-        it("should accept requests from same origin", () => {
+        it("should accept requests from expected SCM provider origin", () => {
             const req = {
                 get: (header: string) => {
-                    if (header === "Origin") return "https://gitpod.io";
+                    if (header === "Origin") return "https://github.com";
                     return undefined;
                 },
-            } as any;
+            } as Partial<express.Request> as express.Request;
 
-            const isValid = nonceService.validateOrigin(req);
+            const isValid = nonceService.validateOrigin(req, "github.com");
             expect(isValid).to.be.true;
         });
 
@@ -84,31 +85,56 @@ describe("NonceService", () => {
                     if (header === "Origin") return "https://evil.com";
                     return undefined;
                 },
-            } as any;
+            } as Partial<express.Request> as express.Request;
 
-            const isValid = nonceService.validateOrigin(req);
+            const isValid = nonceService.validateOrigin(req, "github.com");
             expect(isValid).to.be.false;
         });
 
         it("should reject requests without origin or referer", () => {
             const req = {
                 get: () => undefined,
-            } as any;
+            } as Partial<express.Request> as express.Request;
 
-            const isValid = nonceService.validateOrigin(req);
+            const isValid = nonceService.validateOrigin(req, "github.com");
             expect(isValid).to.be.false;
         });
 
-        it("should accept requests with valid referer", () => {
+        it("should accept requests with valid referer from expected host", () => {
             const req = {
                 get: (header: string) => {
-                    if (header === "Referer") return "https://gitpod.io/login";
+                    if (header === "Referer") return "https://gitlab.com/oauth/authorize";
                     return undefined;
                 },
-            } as any;
+            } as Partial<express.Request> as express.Request;
 
-            const isValid = nonceService.validateOrigin(req);
+            const isValid = nonceService.validateOrigin(req, "gitlab.com");
             expect(isValid).to.be.true;
         });
+
+        it("should work with different SCM providers", () => {
+            const testCases = [
+                { origin: "https://github.com", expectedHost: "github.com", shouldPass: true },
+                { origin: "https://gitlab.com", expectedHost: "gitlab.com", shouldPass: true },
+                { origin: "https://bitbucket.org", expectedHost: "bitbucket.org", shouldPass: true },
+                { origin: "https://github.com", expectedHost: "gitlab.com", shouldPass: false },
+                { origin: "https://evil.com", expectedHost: "github.com", shouldPass: false },
+            ];
+
+            testCases.forEach(({ origin, expectedHost, shouldPass }) => {
+                const req = {
+                    get: (header: string) => {
+                        if (header === "Origin") return origin;
+                        return undefined;
+                    },
+                } as Partial<express.Request> as express.Request;
+
+                const isValid = nonceService.validateOrigin(req, expectedHost);
+                expect(isValid).to.equal(
+                    shouldPass,
+                    `${origin} vs ${expectedHost} should ${shouldPass ? "pass" : "fail"}`,
+                );
+            });
+        });
     });
 });

components/server/src/auth/nonce-service.ts

@@ -79,9 +79,9 @@ export class NonceService {
     }
 
     /**
-     * Validates that the request origin is from a trusted domain
+     * Validates that the request origin is from the expected SCM provider domain
      */
-    validateOrigin(req: express.Request): boolean {
+    validateOrigin(req: express.Request, expectedHost: string): boolean {
         const origin = req.get("Origin");
         const referer = req.get("Referer");
 
@@ -95,10 +95,11 @@ export class NonceService {
 
         try {
             const sourceUrl = new URL(requestSource);
-            const configUrl = new URL(this.config.hostUrl.url.toString());
 
-            // Validate that the request comes from the same origin as our configured host
-            return sourceUrl.origin === configUrl.origin;
+            // Validate that the request comes from the expected SCM provider host
+            // expectedHost could be "github.com", "gitlab.com", etc.
+            const expectedOrigin = `https://${expectedHost}`;
+            return sourceUrl.origin === expectedOrigin;
         } catch (error) {
             // Invalid URL format
             return false;