Azure / Azure/static-web-apps

OpenId Connect Redirect Callback Error When User Cancels

Open
#654 3 comments 1 reaction 0 assignees View on GitHub
AuthN/Z
Dominant language
No language data
Stars
346
Forks
67
PR merge metrics
No merged PRs in 30d

Description

I am currently working on a basic Azure SWA application that is using Azure B2C as its Identity Provider. We have noticed when a user hits "Cancel" in the account creation process it redirects back to the application as expected with an error appended to the callback function URL as a query as such.

`
/.auth/login/b2c/callback?error=access_denied&error_description=AADB2C90091%3a+The+user+has+cancelled+entering+self-asserted+information.%0d%0aCorrelation+ID%3a+165c89e1-8b2a-40e3-9fb8-95560ea6de2f%0d%0aTimestamp%3a+2021-12-07+17%3a48%3a08Z%0d%0a&state=%2f.auth%2fcomplete`

Successful logins and their redirects work as expected. However, this callback erroring is returning a 401 back to the user and displays JSON to the user as if it's an HTTP request (see screenshot below for the white page). We have tried to add a redirect in the configuration to handle response codes of 401 but it seems as if the configuration is being ignored when the 401 is triggered by the callback erroring out. Also adding for more context, this is an out-of-the-box SUSI user flow. Below is my static config file as well, if anyone has any insights or needs further information I'll happily get more detail over.

staticwebappconfig.config.json
```
{
"routes": [
{
"route": "/",
"allowedRoles": [ "authenticated" ]
}
],
"responseOverrides": {
"401": {
"redirect": "/.auth/login/b2c",
"statusCode": 302
}
},
"auth": {
"identityProviders": {
"customOpenIdConnectProviders": {
"b2c": {
"registration": {
"clientIdSettingName": "APP_ID",
"clientCredential": {
"clientSecretSettingName": "APP_SECRET"
},
"openIdConnectConfiguration": {
"wellKnownOpenIdConfiguration":
}
},
"login": {
"nameClaimType": "emails",
"scopes": ["openid"]
}
}
}
}
}
}
```

Cancel button being selected in Azure B2C account creation.
![Screen Shot 2021-12-07 at 12 32 10 PM](https://user-images.githubusercontent.com/15207849/145086428-6228002a-3072-48f7-8dc6-d6bace00527f.png)

Page displayed on redirect when the user has hit the cancel button in account creation.
![Screen Shot 2021-12-07 at 12 24 39 PM](https://user-images.githubusercontent.com/15207849/145085344-985e561b-85ff-48d0-9ae3-d380a223ec2c.png)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.