1 files changed, 20 insertions, 2 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/IDPSingleLogOutServlet.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/IDPSingleLogOutServlet.java
index 0a6d30be7..fe5cd1ac0 100644
--- a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/IDPSingleLogOutServlet.java
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/auth/servlet/IDPSingleLogOutServlet.java
@@ -45,6 +45,7 @@ import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.NOSLOServiceDescripto
 import at.gv.egovernment.moa.id.protocols.pvp2x.exceptions.NoMetadataInformationException;
 import at.gv.egovernment.moa.id.storage.AssertionStorage;
 import at.gv.egovernment.moa.id.storage.AuthenticationSessionStoreage;
+import at.gv.egovernment.moa.id.util.HTTPUtils;
 import at.gv.egovernment.moa.id.util.MOAIDMessageProvider;
 import at.gv.egovernment.moa.id.util.Random;
 import at.gv.egovernment.moa.logging.Logger;
@@ -62,6 +63,23 @@ public class IDPSingleLogOutServlet extends AuthServlet {
 	protected void doGet(HttpServletRequest req, HttpServletResponse resp)
 			    throws ServletException, IOException {
 		Logger.debug("receive IDP SingleLogOut Request");
+		
+		String authURL = HTTPUtils.extractAuthURLFromRequest(req);
+		try {
+			if (!AuthConfigurationProviderFactory.getInstance().getPublicURLPrefix().contains(authURL)) {		
+				Logger.warn("Requested URL " + authURL + " is not in PublicPrefix Configuration");
+				resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Request not allowed");
+				return;
+			
+			}
+			
+		} catch (MOAIDException e) {
+			Logger.error("Internal Server Error.", e);
+			resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Internal Server Error");
+			return;
+			
+		}
+		
 		SSOManager ssomanager = SSOManager.getInstance();		
 		String ssoid = ssomanager.getSSOSessionID(req);
 		
@@ -109,7 +127,7 @@ public class IDPSingleLogOutServlet extends AuthServlet {
 						AuthenticationSession authSession = AuthenticationSessionStoreage
 								.getSession(moaSessionID);
 						if(authSession != null) {
-							authmanager.performSingleLogOut(req, resp, authSession, null);
+							authmanager.performSingleLogOut(req, resp, authSession, authURL);
 							return;
 							
 						}
@@ -142,7 +160,7 @@ public class IDPSingleLogOutServlet extends AuthServlet {
 															
 						} else {
 							//print SLO information directly
-							redirectURL = AuthConfigurationProviderFactory.getInstance().getPublicURLPrefix() + "/idpSingleLogout";
+							redirectURL = HTTPUtils.extractAuthURLFromRequest(req) + "/idpSingleLogout";
 							
 							String artifact = Random.nextRandom();