-
Notifications
You must be signed in to change notification settings - Fork 204
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
add follow redirect params flag in oauth2 final response #318
base: master
Are you sure you want to change the base?
add follow redirect params flag in oauth2 final response #318
Conversation
I'm not sure what this is for. There's already a mechanism for redirecting somewhere based on the redir url parameter that gets passed at the beginning of the OAuth2 flow. |
Hi Aaron, thanks for your reply :) The problem is that in the redirector module, there's a check about that parameter (followRedirParam), to know if the redirector has to check or not the redirect parameter (if it is allowed). To solve the problem, i wrote a new custom redirector, that checks if the "success" param in redirect options struct is not "". In that case i Know that the login operation ended, so i can do custom checks on the redirect path. |
There exists redirect mechanisms specific to Oauth2 that are separate from what you're talking about: https://github.com/volatiletech/authboss/blob/master/oauth2/oauth2.go#L132 Pretty sure some combination of these things will suit your use case? |
Thank you again aaron for your answer.
I missed to write that my problem born because i want to allow some redirect url containing https:// if they belong to a list of allowed url. So, in my redirector version, the redirect API method from this
it becames something like...
But if i write something similiar in the non API redirect method, it won't work cause it is called also for provider redirect url, so the only know if i have to check the path parameter (in oauth2 "redir" is not used) is to check if the "success" message is not empty. So the user logged in, status message is not empty, i can check if the redirect url is allowed. So, in the redirect non API method, i had to write something like:
|
Okay, so one of the key issues here is that your Redirector implementation has custom code in it that you want to activate, rather than using the secondary redirection mechanism built into the OAuth2 module. Is that correct? |
Yes, this is correct. |
Without the follow redir param set to true, it's not so direct to test in the RedirectNonApi method of the redirector if the redir path contains the oauth2 provider authentication url or the user's redirect url typed in the url query.
In the redirect API method, the followRedirectParam field is used to checks the value of redir, in oauth2 it's not set after login.
I just added followRedirOptions = true in the redirect options built at the end of the "End" method after a oAuth2 login.