Skip to content

Preserve original redirect_uri hash fragment when parsing authentication response #28

@dmitrizagidulin

Description

@dmitrizagidulin

Refactor browser-util.js / clearHashFragment() to preserve the original hash fragment while clearing out oidc-related hash fragment parameters.

For example, user requests the page https://example.com/resource#someHashFragment, and initiates a WebID-OIDC login flow.
The client will send redirect_uri=https://example.com/resource#someHashFragment as part of its implicit authorization flow. On the return step, the user's browser will be redirected back to the redirect_uri with additional credentials and auth-related parameters. It will be 302 redirected to:
https://example.com/resource#someHashFragment&id_token=...&state=... etc.

In currentSession(), when parsing the response and clearing the hash fragment of the uri, only the following hash fragment params need to be cleared out (see OIDC ImplicitAuthResponse):

  • id_token
  • access_token
  • state
  • token_type
  • expires_in

So that the resulting cleared uri should be https://example.com/resource#someHashFragment.

(Affects downstream issue nodeSolidServer/node-solid-server#571)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions