[Question] Post authentication redirect to requested URL

[Roger-Sa]

Hi,

I'm using AAD authentication. Let's say I have an app at myapp.com and a user wants to access myapp.com/product?id=123 (which might be bookmarked, for instance). If the user is already logged in this works fine, but if he needs to log in, post authentication redirects the user to myapp.com not the requested URL. I know I can configure a post login redirect, but this needs to be a fixed URL. Is it somehow possible for post authentication to redirect the user to where he/she intended to go?

[anthonychu]

I don't think this is possible right now, though it's something we should look into supporting. @mkarmark any suggestions?

[Roger-Sa]

I am reading here that, due to security implications:

According to the OAuth 2.0 specification (section 3.1.2 of RFC 6749), a redirection endpoint URI must be an absolute URI.

and:

If you have several subdomains and your scenario requires that, upon successful authentication, you redirect users to the same page from which they started, using a state parameter might be helpful.

I presume this can be done with custom authentication. I also presume most prefer to just use the built-in authentication. If you (Microsoft) implement this for the built-in authentication, and automatic redirection is out of the question for security reasons, then probably make the requested URL available somehow (some endpoint similar to /.auth/me perhaps?).

[rellis-of-rhindleton]

I found this on Customize sign-ins and sign-outs — would it be applicable to Static Web Apps as well?

After users sign in to your app, they usually want to be redirected to the same section of the same page, such as /wiki/Main_Page#SectionZ. However, because URL fragments (for example, #SectionZ) are never sent to the server, they are not preserved by default after the OAuth sign-in completes and redirects back to your app. Users then get a suboptimal experience when they need to navigate to the desired anchor again. This limitation applies to all server-side authentication solutions.

In App Service authentication, you can preserve URL fragments across the OAuth sign-in. To do this, set an app setting called WEBSITE_AUTH_PRESERVE_URL_FRAGMENT to true.

[brenoalvs]

Any news on this?
Currently I think the only way to do it is by implementing this kind of logic on the app side which does not make any sense when you are using the built in auth.

[ghost]

My company is facing the same issue and we really were using this for our documentation site to include articles and code documents at one place for the company. But this is a very bad end user experience since we have variety of readers of our documentation who like to have their fully qualified/favorited URLs within our HUGE site. They have to navigate through the content since they always end up landing at the Home Page post authentication.

[mishapos]

We now support adding "post_login_redirect_uri=.referrer" to achieve the behavior of redirecting back to the page before the login flow started. Query parameters and fragments are not supported though.

[Roger-Sa]

@mishapos
What is the correct usage exactly?

Tried this in staticwebapp.config.json:

{
   "route": "/login",
   "redirect": "/.auth/login/aad?post_login_redirect_uri=.referrer" 
}

But get redirected to .../.auth/.referrer

[anthonychu]

This is a fairly new feature and we're waiting for query string support to be added, so we haven't documented it yet. You can only use it in a response override:

{
  "routes": [
    {
      "route": "/*",
      "allowedRoles": [
        "authenticated"
      ]
    }
  ],
  "responseOverrides": {
    "401": {
      "statusCode": 302,
      "redirect": "/.auth/login/github?post_login_redirect_uri=.referrer"
    }
  }
}

[Roger-Sa]

Awesome! It works!

[msardi23]

This is a fairly new feature and we're waiting for query string support to be added, so we haven't documented it yet. You can only use it in a response override:

{
  "routes": [
    {
      "route": "/*",
      "allowedRoles": [
        "authenticated"
      ]
    }
  ],
  "responseOverrides": {
    "401": {
      "statusCode": 302,
      "redirect": "/.auth/login/github?post_login_redirect_uri=.referrer"
    }
  }
}

This is great and works once changes are pushed back to Azure Static Apps service.
However, the local auth emulator fails / hangs when the app is run locally with the swa cli.
Is there a fix in the works for the swa cli or a work around available?

[manlm]

This is a fairly new feature and we're waiting for query string support to be added, so we haven't documented it yet. You can only use it in a response override:

{
  "routes": [
    {
      "route": "/*",
      "allowedRoles": [
        "authenticated"
      ]
    }
  ],
  "responseOverrides": {
    "401": {
      "statusCode": 302,
      "redirect": "/.auth/login/github?post_login_redirect_uri=.referrer"
    }
  }
}

When I click the link on facebook workplace chat, this does not work. Are there any update on this case?

[ghost]

We now support adding "post_login_redirect_uri=.referrer" to achieve the behavior of redirecting back to the page before the login flow started. Query parameters and fragments are not supported though.

@mishapos does this mean the encoding is also not supported (like %20 for space)? I tested and see that redirection works only as long as the URL does not contain a space.

Example:
This works: https://something.com/articles/EXTERNAL/README.html
This does not work: https://something.com/articles/INTERNAL/Some%20Configuration/Some%20Add%20User/Some%20Add%20User.html

[gbelenky]

Is it also supposed to work in the swa cli during the local development? It did not work for me

[waterskijubilant]

This does not work if the link is clicked from another site.

Edit: Slight correction, if you open a fresh browser instance it works as expected for 30 seconds, then if you try it again it starts redirecting to the root page.

[niand]

I am getting the same behaviour as mentioned above. The redirect to a specific subpage works on fresh browser, afterwords I end up on the root url again.

#693

[MattParkerDev]

Has there been any progress on supporting query parameters in the post login redirect uri?

[brettnf]

Query parameters and fragments are not supported though.

@mishapos

Are there any plans to support fragments, as it is already the case for web apps?
Would be very helpful as we share links to our documentation where it is important to also jump directly to section headings...