Fix OIDC issuer domain spoofing in B2C host validation

[4gust]

Problem

The OIDC issuer validation in has_valid_issuer() used endswith(domain) to check B2C hosts, which allows malicious domains to pass validation #891:

# Before: fakeb2clogin.com passes because it endswith("b2clogin.com")
issuer_host.endswith(h)  # h = "b2clogin.com"

Fix

Require a dot separator to ensure only true subdomains match:

issuer_host.endswith("." + h)  # Only matches *.b2clogin.com

Tests

Added 5 tests covering spoofing scenarios (fakeb2clogin.com, evilb2clogin.com, b2clogin.com.evil.com, fakeciamlogin.com) and valid subdomain acceptance.

[Copilot]

Pull request overview

This PR hardens OIDC issuer validation for B2C/CIAM authorities by preventing domain-suffix spoofing in Authority.has_valid_issuer(), aligning issuer-host checks with safer subdomain matching.

Changes:

• Strengthened B2C/CIAM issuer host validation to require a dot-separated suffix match (e.g., *.b2clogin.com).
• Added unit tests covering multiple spoofed-domain scenarios plus a valid subdomain acceptance case.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
msal/authority.py	Updates issuer-host validation logic to prevent endswith(domain) spoofing.
tests/test_authority.py	Adds regression tests for spoofed issuer hosts and valid B2C subdomain behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gladjohn]

🚢