fix(http): don't redirect query-string URLs on private containers - #141
Open
bourgeoa wants to merge 1 commit into
Open
fix(http): don't redirect query-string URLs on private containers#141bourgeoa wants to merge 1 commit into
bourgeoa wants to merge 1 commit into
Conversation
PivotResponseWriter intercepted 401/403/404 GET responses and redirected to a trailing-slash variant of the URL, but it checked the raw request URL (which includes the query string) for the trailing slash. As a result, OIDC redirects back to a private container (e.g. /?code=...&state=...&iss=...) were 301-redirected to a query-less '//' URL, dropping the authorization code and breaking login on non-public-readable containers. Only canonicalize when the identifier path genuinely lacks a trailing slash, so private containers return their normal 401 with the query string intact and the login flow can complete.
|
Is that custom to Pivot? Because #324 occurred on a rather plain (yet custom WAC for client checks) of CSS (I am not running Pivot). |
Member
Author
|
From m'y tests this is Pivot specific. You can test login with any pod account to https://solidweb.me/bourgeoa1/settings/ with a / at end So yes the issue do not appear on a clean CSS that do not accept URL container not ending with / |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PivotResponseWriter intercepted 401/403/404 GET responses and redirected to a trailing-slash variant of the URL, but it checked the raw request URL (which includes the query string) for the trailing slash. As a result, OIDC redirects back to a private container (e.g. /?code=...&state=...&iss=...) were 301-redirected to a query-less '//' URL, dropping the authorization code and breaking login on non-public-readable containers.
Only canonicalize when the identifier path genuinely lacks a trailing slash, so private containers return their normal 401 with the query string intact and the login flow can complete.