require sso redirect url to be an argo url (#6211)

Signed-off-by: Brandon Goode <brandon.goode@cox.com>

Co-authored-by: Alex Collins <alexec@users.noreply.github.com>

server/auth/sso/sso.go

@@ -264,7 +264,14 @@ func (s *sso) HandleCallback(w http.ResponseWriter, r *http.Request) {
 		Secure:   s.secure,
 	})
 	redirect := s.baseHRef
-	if cookie.Value != "" {
+
+	proto := "http"
+	if s.secure {
+		proto = "https"
+	}
+	prefix := fmt.Sprintf("%s://%s%s", proto, r.Host, s.baseHRef)
+
+	if strings.HasPrefix(cookie.Value, prefix) {
 		redirect = cookie.Value
 	}
 	http.Redirect(w, r, redirect, 302)