[WIP - Help wanted!] Ensure preservation of return_to through OAuth login flow

[jywarren]

Fixes #3384

I think this is only the beginning -- i'm not setting the session[:return_to] in the right places, nor am I setting up the redirects thoroughly... and it could probably use some refinement to not have redundant code.

[plotsbot]

	1 Message
📖	@jywarren Thank you for your pull request! I’m here to help with some tips and recommendations. Please take a look at the list provided and help us review and accept your contribution! And don’t be discouraged if you see errors – we’re here to help.

Generated by 🚫 Danger

[Radhikadua123]

@jywarren Wow, this seems to be quite interesting issue. I was thinking about approach to it.

What about this:

1. All the third party login icons will point to /redirect?from=#{url}&to=/auth/#{provider}.
2. In that GET view:
   2.1 if user is already logged in, redirect user to from url. (handling edge case)
   2.2 if user is not logged in, just get the existing session or create new one. In that session, save the return_to url and redirect user to to url from get parameters.
3. When callback from third party login is called, on success, we check if return_to is set in session or not. If it is set, then just redirect user to that url.

I'm not sure how well would it address the issue. I might have missed something.

[jywarren]

That sounds like a great approach, although it did seem to me that we might be able to set the session in the oath login route itself? But maybe I'm mixed up. If you'd like to try this out, we'd love some help!!!

…

On Tue, Oct 30, 2018, 5:49 PM Radhika Dua ***@***.*** wrote: @jywarren <https://github.com/jywarren> Wow, this seems to be quite interesting issue. I was thinking about approach to it. What about this: 1. All the third party login icons will point to /redirect?from=#{url}&to=/auth/#{provider}. 2. In that GET view: 2.1 if user is already logged in, redirect user to from url. (handling edge case) 2.2 if user is not logged in, just get the existing session or create new one. In that session, save the return_to url and redirect user to to url from get parameters. 3. When callback from third party login is called, on success, we check if return_to is set in session or not. If it is set, then just redirect user to that url. I'm not sure how well would it address the issue. I might have missed something. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#3762 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AABfJ4A44ANws-1gLhAV4eMQNoJRI1_Aks5uqMlVgaJpZM4X5JAx> .

[Radhikadua123]

Sure, I'll try it out tomorrow. Thanks!

[jywarren]

Deferring to #3879