From ad63bca949c3c51d6e83e92e33b52dd3a1db0a84 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 7 Aug 2026 07:36:16 +0000
Subject: [PATCH 1/2] Initial plan


From e4a166aff554ff86f97ea38bb7096deaf1ce1311 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 7 Aug 2026 07:42:24 +0000
Subject: [PATCH 2/2] Fix alert #16: use UriHelper.BuildAbsolute to prevent
 open redirect

Co-authored-by: BenjaminMichaelis <22186029+BenjaminMichaelis@users.noreply.github.com>
---
 EssentialCSharp.Web/Program.cs | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/EssentialCSharp.Web/Program.cs b/EssentialCSharp.Web/Program.cs
index 42df3e32..24e14289 100644
--- a/EssentialCSharp.Web/Program.cs
+++ b/EssentialCSharp.Web/Program.cs
@@ -15,6 +15,7 @@
 using EssentialCSharp.Web.Tools;
 using Mailjet.Client;
 using Microsoft.AspNetCore.Authentication;
+using Microsoft.AspNetCore.Http.Extensions;
 using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.AspNetCore.Identity;
 using Microsoft.AspNetCore.Identity.UI.Services;
@@ -454,7 +455,9 @@ await context.HttpContext.Response.WriteAsync(
                 ? configuredBaseUri.Host[4..]
                 : configuredBaseUri.Host;
             string wwwHost = $"www.{apexHost}";
-            string redirectAuthority = new UriBuilder(configuredBaseUri) { Host = apexHost }.Uri.GetLeftPart(UriPartial.Authority);
+            Uri apexUri = new UriBuilder(configuredBaseUri) { Host = apexHost }.Uri;
+            string redirectScheme = apexUri.Scheme;
+            HostString redirectHost = new HostString(apexUri.Authority);
 
             app.UseExceptionHandler(exceptionApp =>
             {
@@ -531,7 +534,7 @@ await McpJsonRpcResponseWriter.WriteErrorAsync(
             {
                 if (string.Equals(context.Request.Host.Host, wwwHost, StringComparison.OrdinalIgnoreCase))
                 {
-                    string redirectUrl = $"{redirectAuthority}{context.Request.PathBase}{context.Request.Path}{context.Request.QueryString}";
+                    string redirectUrl = UriHelper.BuildAbsolute(redirectScheme, redirectHost, context.Request.PathBase, context.Request.Path, context.Request.QueryString);
                     context.Response.Redirect(redirectUrl, permanent: true);
                     return;
                 }