fix: block spoofable IP headers from rate limiting and restrict SAML RelayState redirects

[strehle]

fix: block spoofable IP headers from rate limiting and restrict SAML) RelayState redirects

[Copilot]

Pull request overview

This PR tightens redirect and client-IP handling in the UAA server by (1) restricting SAML RelayState / redirect override URLs to the same host to reduce open-redirect risk, and (2) expanding the default set of filtered (spoofable) IP-related headers so rate limiting won’t trust them by default.

Changes:

• Restrict SAML RelayState redirects to URLs whose host matches the current request host.
• Restrict override.redirect_uri and form_redirect_uri handling to same-host URLs.
• Add X-Client-IP and X-Real-IP to the default servlet.filtered-headers list.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
server/src/main/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandler.java	Enforces same-host validation for RelayState and redirect override/form parameters.
server/src/main/java/org/cloudfoundry/identity/uaa/UaaProperties.java	Extends default filtered headers to include X-Client-IP / X-Real-IP.
server/src/test/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandlerTests.java	Updates/extends tests to assert same-host acceptance and external-host rejection.
server/src/test/java/org/cloudfoundry/identity/uaa/UaaPropertiesTest.java	Updates defaults test to include the newly filtered headers.

Comments suppressed due to low confidence (1)

server/src/main/java/org/cloudfoundry/identity/uaa/web/UaaSavedRequestAwareAuthenticationSuccessHandler.java:76

• This redirect validation depends on UaaUrlUtils.uriHasMatchingHost, which currently performs a case-sensitive hostname comparison and is not null-safe for the hostname argument. With the newly added host restriction, that can cause legitimate same-host override URLs to be rejected unexpectedly. Consider fixing uriHasMatchingHost centrally to compare hosts case-insensitively and handle nulls.

    public String determineTargetUrl(HttpServletRequest request, HttpServletResponse response) {
        String redirectAttribute = request.getAttribute(URI_OVERRIDE_ATTRIBUTE) instanceof String overrideString ? overrideString : null;
        String redirectFormParam = request.getParameter(FORM_REDIRECT_PARAMETER);
        if (redirectAttribute != null && UaaUrlUtils.uriHasMatchingHost(redirectAttribute, request.getServerName())) {
            log.debug("Returning redirectAttribute saved URI: {}", redirectAttribute);
            return redirectAttribute;
        } else if (UaaUrlUtils.uriHasMatchingHost(redirectFormParam, request.getServerName())) {
            return redirectFormParam;