fix(W-23836436): allow dpop_jkt on login pool servers - #4130
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dev #4130 +/- ##
==========================================
+ Coverage 67.13% 71.53% +4.40%
==========================================
Files 254 254
Lines 22678 22679 +1
==========================================
+ Hits 15224 16224 +1000
+ Misses 7454 6455 -999
🚀 New features to boost your workflow:
|
wmathurin
force-pushed
the
dpop-jkt-pool-servers
branch
2 times, most recently
from
August 13, 2026 00:41
cf49cfe to
47a0669
Compare
|
||||||||||||||
wmathurin
force-pushed
the
dpop-jkt-pool-servers
branch
2 times, most recently
from
August 13, 2026 01:03
bc9f998 to
b0bb8f0
Compare
Pool servers (login.salesforce.com, test.salesforce.com) now support DPoP authorization code binding. Remove the isPoolLoginHost guard from appendDPoPJktIfNeededTo:domain:credentials: so dpop_jkt is sent for all login servers when DPoP is enabled. - Invert two pool-host unit tests in SFOAuthCoordinatorTests - Add loginPoolHost top-level field to ui_test_config.json.sample - Add useLoginPoolHost param to BaseAuthFlowTester.login/launchLoginAndValidate - Add test_givenDPoP_whenLoginViaPoolServer_thenTokenTypeIsDPoP to DPoPLoginTests
wmathurin
force-pushed
the
dpop-jkt-pool-servers
branch
from
August 13, 2026 01:04
b0bb8f0 to
bf8d6b3
Compare
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
sfdctaka
reviewed
Aug 13, 2026
- SFOAuthCoordinator.m: remove redundant _approvalCode = nil in dealloc (ARC zeros strong ivars automatically) to clear Clang analyzer warning [nullability.NullPassedToNonnull] at line 124. - SFOAuthCoordinator.m: replace _authInfo = nil with a known non-nil default (SFOAuthTypeUnknown) in stopAuthentication to clear the same analyzer warning at line 295; consistent with the authInfo lazy-init getter. - BaseAuthFlowTester.swift: replace try? with do/catch + XCTFail + return on the getLoginPoolHost() call site so a missing/empty loginPoolHost key fails loudly instead of silently falling through to the regular login host. - SFOAuthCoordinatorTests.swift: add test for the domain == nil guard in appendDPoPJktIfNeededTo:domain:credentials:, exercised via the ObjC runtime since the caller (approvalURLForEndpoint:) asserts domain non-nil before the helper is reached from the normal path.
… README - XCTSkip test_givenDPoP_whenLoginViaPoolServer_thenTokenTypeIsDPoP — server-side bug W-23864247 causes invalid_dpop_proof on the authorization-code token exchange at login.test1.pc-rnd. Re-enable when server fix is confirmed. - Add README.md for iOS AuthFlowTester with full test suite documentation
test_givenDPoPECA_whenAdminLogin_thenDPoPBindingWorksThroughSafariVC renamed to test_givenDPoPECA_whenAdminLogin_thenDPoPBindingWorksThroughBrowser — the SDK uses ASWebAuthenticationSession for Login for Admin, not SFSafariViewController.
Contributor
Author
|
I was able to run all the UI tests locally successfully. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
isPoolLoginHostguard fromappendDPoPJktIfNeededTo:domain:credentials:inSFOAuthCoordinator.m— pool servers now support DPoP authorization code bindingwelcome.salesforce.com/discoveryis unaffected (it is a discovery endpoint and never directly receives an/authorizerequest)Known limitation — server-side bug W-23864247
During testing against
login.test1.pc-rnd.salesforce.com, the token exchange returns HTTP 400invalid_dpop_proofeven though the client's DPoP proof is cryptographically correct and its JWK thumbprint exactly matches thedpop_jktsent in/authorize. This is a server-side issue filed as W-23864247 (Auth Protocols team).test_givenDPoP_whenLoginViaPoolServer_thenTokenTypeIsDPoPthrowsXCTSkipuntil the server fix is confirmed.Changes
Production code
SFOAuthCoordinator.m— remove[SFSDKAuthConfigUtil isPoolLoginHost:domain]early-exit; onlydomain == nilexits earlyUnit tests
SFOAuthCoordinatorTests.swift— invert two pool-host tests:login.salesforce.comandtest.salesforce.comnow assertdpop_jktpresent (renamedthenUrlHasDPoPJkt)welcome.salesforce.com/discoverytest unchanged (still asserts absent)UI tests (AuthFlowTester)
ui_test_config.json.sample— add top-levelloginPoolHostfieldUITestConfigUtils.swift— addloginPoolHost: String?toTestConfig; addgetLoginPoolHost()accessorBaseAuthFlowTester.swift— adduseLoginPoolHost: Bool = falsetologin()andlaunchLoginAndValidate(); when true, configures the pool server URL as the login host while keeping credentials from the specifiedloginHostDPoPLoginTests.swift— addtest_givenDPoP_whenLoginViaPoolServer_thenTokenTypeIsDPoP(XCTSkippending W-23864247); renametest_givenDPoPECA_whenAdminLogin_thenDPoPBindingWorksThroughSafariVC→ThroughBrowserTest plan
SFOAuthCoordinatorTests— all 18 tests pass (verified locally)DPoPLoginTests.test_givenDPoP_whenLoginViaPoolServer_thenTokenTypeIsDPoP— blocked on server bug W-23864247GUS
W-23836436 — [iOS] Allow dpop_jkt on login pool servers (/authorize code binding)