Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bug: return_to query parameter is not enforced if user is already logged-on #2805

Closed
5 of 6 tasks
supercairos opened this issue Oct 14, 2022 · 0 comments
Closed
5 of 6 tasks
Labels
bug Something is not working.

Comments

@supercairos
Copy link
Contributor

Preflight checklist

Describe the bug

If a user is already logged-in and tries to to use the browser registration flow,
he only gets redirected to the default_redirect_url instead of observing the return_to parameter setup in the URL.

For comparaison, the Login flow works as intended;

Reproducing the bug

  1. Login to your kratos instance
  2. try to query a browser registration flow with a return_to setup
  3. notice you're redirected to the default page;

Relevant log output

No response

Relevant configuration

selfservice:
  default_browser_return_url: XXXX
  allowed_return_urls:
    - YYY

Version

v0.10.1

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

Kubernetes

Additional Context

Bug seams to be around here:

Registration:
https://github.com/ory/kratos/blob/master/selfservice/flow/registration/handler.go#L252

Login:
https://github.com/ory/kratos/blob/master/selfservice/flow/login/handler.go#L353

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something is not working.
Projects
None yet
Development

No branches or pull requests

1 participant