Allow multiple oAuth redirect domains

[daffl]

This is an issue brought up in #2430 and by @cliffvick and confirmed by @mrfrase3: Currently oAuth authentication only supports redirecting to a single frontend URL after a successful login. However, sometimes you may want to authenticate the same API with different frontends using dynamic redirects. This can already be done by customizing the oAuth strategy getRedirect like this:

https://gist.github.com/daffl/d0dee9cda7eee3d270bc99a1f1c67d9b

It might be worth adding an additional configuration option of allowedRedirects that takes an array of allowed URLs and checks the dynamic query redirect against that list similar to the above Gist.

[mrfrase3]

For what it's worth, this was my solution, pretty similar:

  async getRedirect(data, params) {
    const queryRedirect = params?.redirect || '';
    const redirectOrigin = params?.query?.redirectOrigin || '';
    const { redirect, redirectOrigins } = this.authentication.configuration.oauth;

    if (!redirect) {
      return null;
    }

    let redirectUrl = `${redirect}${queryRedirect}`;
    if (redirectOrigins?.includes(redirectOrigin)) {
      redirectUrl = `${redirectOrigin}${queryRedirect}`;
    }

    const sepChar = (redirect.indexOf('#') !== -1 ? '?' : '#');
    const separator = redirect.endsWith('?') || redirect.endsWith('#') ? '' : sepChar;
    const authResult = data;
    const query = authResult.accessToken ? {
      access_token: authResult.accessToken,
    } : {
      error: data.message || 'OAuth Authentication not successful',
    };

    return `${redirectUrl}${separator}${querystring.stringify(query)}`;
  }

[cliffvick]

This is interesting. While I’m assuming that `redirectOrigins` is an added slot in the oauth section of the configuration and is an array of acceptable origins, I’m not familiar with the query parameter `redirectOrigin`. When I run your code, `redirectOrigin` never has a value. Is there something that I have to do to enable this? How does it work? Assuming that the value is the origin from the original request (value of original “Referer” maybe?), how does it get transferred through the other redirects that occur during the OAuth flow (session?). I want to understand :) Cheers, Cliff

…

On Aug 17, 2021, at 1:28 AM, Fraser ***@***.***> wrote: For what it's worth, this was my solution: async getRedirect(data, params) { const queryRedirect = params?.redirect || ''; const redirectOrigin = params?.query?.redirectOrigin || ''; const { redirect, redirectOrigins } = this.authentication.configuration.oauth; if (!redirect) { return null; } let redirectUrl = `${redirect}${queryRedirect}`; if (redirectOrigins?.includes(redirectOrigin)) { redirectUrl = `${redirectOrigin}${queryRedirect}`; } const sepChar = (redirect.indexOf('#') !== -1 ? '?' : '#'); const separator = redirect.endsWith('?') || redirect.endsWith('#') ? '' : sepChar; const authResult = data; const query = authResult.accessToken ? { access_token: authResult.accessToken, } : { error: data.message || 'OAuth Authentication not successful', }; return `${redirectUrl}${separator}${querystring.stringify(query)}`; } — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2430 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAARWPKEFYEFIJ23RLJ3IGLT5HXRTANCNFSM5CINZM5A>.

[mrfrase3]

The url should look something like this:
https://api.example.com/oauth/google?redirectOrigin=https%3A%2F%2Fadmin.example.com&redirect=%2Flogin

you can generate it like:

const { origin } = window.location;
`https://api.example.com/oauth/google?redirectOrigin=${encodeURIComponent(origin)}&redirect=/login`

I definitely wouldn't call my solution better, just different.

[daffl]

I like that because it means that the redirect query parameter logic would still be the same and the default origin would be the authentication.oauth.redirect. My thought would be calling it just origin in the query and allowOrigin in the configuration.

[mrfrase3]

I think maybe a combo solution that detects /^https?:\/\// at the front of the redirect param. That way you could do the following:

const { href } = window.location;
`https://api.example.com/oauth/google?redirect=${encodeURIComponent(href)}`

[daffl]

Thinking more about it, the default could be to use the HTTP referrer URL if it is in the list of allowed redirects. That way there may not even be a need for the current redirect option and you don't necessarily have to set the redirect query parameter.