fix(auth): resolve callback URLs against the app origin server-side

`validateCallbackUrl` compared against a sentinel base
(`https://callback-url-validator.invalid`) when `window` was undefined, so
the server rejected every absolute URL — including the same-origin ones the
function documents as valid. A component deriving a callback URL during
render therefore produced one destination in the SSR markup and a different
one after hydration.

The exposure was not new to the SSO form: `login-form.tsx` and
`signup-form.tsx` already derive their callback URL during render on
`force-dynamic` pages, so both carried the same divergence.

- resolve against the deployment's own origin server-side, so the server
  reaches the same verdict the browser will after hydration
- fall back to the sentinel when the app URL is unset or unparseable, which
  keeps the server fail-closed: absolute URLs are rejected, as before
- cover the absolute same-origin case and the unset-app-URL fallback in the
  existing suite; all 15 open-redirect rejection cases are unchanged

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.test.ts

@@ -1,4 +1,4 @@
-import { envFlagsMock, resetEnvFlagsMock } from '@sim/testing'
+import { defaultMockEnv, envFlagsMock, resetEnvFlagsMock, resetEnvMock, setEnv } from '@sim/testing'
 import { afterAll, afterEach, beforeEach, describe, expect, it } from 'vitest'
 import {
   validateAirtableId,
@@ -2136,6 +2136,7 @@ describe('validateCallbackUrl', () => {
   })
 
   afterEach(() => {
+    resetEnvMock()
     if (originalWindow === undefined) {
       ;(globalThis as { window?: unknown }).window = undefined
     } else {
@@ -2187,12 +2188,28 @@ describe('validateCallbackUrl', () => {
       ;(globalThis as { window?: unknown }).window = undefined
     })
 
-    it('falls back to placeholder origin and still rejects cross-origin URLs', () => {
+    it('resolves against the configured app origin and still rejects cross-origin URLs', () => {
       expect(validateCallbackUrl('/workspace')).toBe(true)
       expect(validateCallbackUrl('//evil.com')).toBe(false)
       expect(validateCallbackUrl('https://evil.com')).toBe(false)
       expect(validateCallbackUrl('javascript:alert(1)')).toBe(false)
     })
+
+    /**
+     * The server verdict has to match what the browser will decide once it
+     * hydrates, or a callback URL derived during render yields one destination
+     * in the SSR markup and another after hydration.
+     */
+    it('accepts an absolute same-origin URL, matching the browser verdict', () => {
+      expect(validateCallbackUrl(`${defaultMockEnv.NEXT_PUBLIC_APP_URL}/workspace/abc`)).toBe(true)
+    })
+
+    it('stays fail-closed on absolute URLs when the app URL is unset', () => {
+      setEnv({ NEXT_PUBLIC_APP_URL: undefined })
+
+      expect(validateCallbackUrl(`${defaultMockEnv.NEXT_PUBLIC_APP_URL}/workspace/abc`)).toBe(false)
+      expect(validateCallbackUrl('/workspace')).toBe(true)
+    })
   })
 })
 

apps/sim/lib/core/security/input-validation.ts

@@ -2,6 +2,7 @@ import { createLogger } from '@sim/logger'
 import { isLoopbackIp, isPrivateIp, unwrapIpv6Brackets } from '@sim/security/ssrf'
 import * as ipaddr from 'ipaddr.js'
 import { isHosted } from '@/lib/core/config/env-flags'
+import { getBaseUrl } from '@/lib/core/utils/urls'
 
 const logger = createLogger('InputValidation')
 
@@ -1234,6 +1235,31 @@ export function validatePaginationCursor(
 
 const CALLBACK_URL_SERVER_BASE = 'https://callback-url-validator.invalid'
 
+/**
+ * Origin a callback URL is resolved and compared against.
+ *
+ * The browser uses its own origin. Server-side there is no `window`, so it uses
+ * the deployment's configured origin — which is what the browser will compare
+ * against once it hydrates. Using a sentinel here instead made the server reject
+ * every absolute URL, including the same-origin ones this function documents as
+ * valid, so a component deriving a callback URL during render produced one
+ * destination in the SSR markup and a different one after hydration.
+ *
+ * Falls back to the sentinel when the app URL is unset or unparseable, which
+ * keeps the server fail-closed: every absolute URL is rejected, as before.
+ */
+function getCallbackValidationOrigin(): string {
+  if (typeof window !== 'undefined') {
+    return window.location.origin
+  }
+
+  try {
+    return new URL(getBaseUrl()).origin
+  } catch {
+    return CALLBACK_URL_SERVER_BASE
+  }
+}
+
 /**
  * Validates a callback URL to prevent open redirect attacks.
  *
@@ -1263,7 +1289,7 @@ export function validateCallbackUrl(url: string): boolean {
   try {
     if (typeof url !== 'string' || url.length === 0) return false
 
-    const base = typeof window === 'undefined' ? CALLBACK_URL_SERVER_BASE : window.location.origin
+    const base = getCallbackValidationOrigin()
     const parsed = new URL(url, base)
     return parsed.origin === base
   } catch (error) {