Kong / Kong/insomnia

OAuth2 Authorization Code flow does not capture code from fragment param

Open
#6,443 0 comments 0 reactions 0 assignees View on GitHub
A-oauth B-bug S-unverified
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

### Expected Behavior

A code flow resulting in an `#code=...` should result in a successful OAuth2 token acquisition, when a `REDIRECT URL` is set, even if the actual cannot be navigated to (for example to an [Application URI Scheme](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/aa767914(v=vs.85)?redirectedfrom=MSDN): `my-application://oauth2`)

Alternatively this could also be a feature request to allow defining '[response_mode](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow#request-an-authorization-code)' as part of the OAuth2 Advanced Options, but I'm not sure if this would fix the issue, depending on if the 'broken' final navigation to the redirect is the issue or if it's the fragment param.

### Actual Behavior

The login window asks which application should be used to open the URL and then stays open on a blank page, without any result.
Inspecting the network OAuth DevTools shows a 302 response with `#code=...` Location header.

### Reproduction Steps

Prerequisite: the identity provider

1. Click on Auth Tab
2. Select OAuth 2.0
3. Ensure Enabled is checked
4. Grant Type :: Authorization Code
5. Authorization URL :: is set
6. Access Token URL :: is set
7. Client ID :: is set
8. Client Secret :: is set
9. **Redirect URL :: is set to an URL with an Application URI Scheme**
10. Click Fetch Tokens

### Is there an existing issue for this?

- [X] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.

### Additional Information

Potentially related to changes in https://github.com/Kong/insomnia/pull/5763
I'm happy to take a jab at the issue myself :)

### Insomnia Version

2023.5.7

### What operating system are you using?

Windows

### Operating System Version

Win 10 22H2

### Installation method

chocolatey

### Last Known Working Insomnia version

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the OAuth 2.0 Authorization Code flow in the Auth Tab and compare the behavior with the changes in pull request #5763. Reproduce the Windows application-URI redirect case, then verify that a callback URL containing a fragment code completes token acquisition instead of leaving the login window blank.

Written by the indexing model from the issue text.

Assessment

Tech stack
electron, typescript
Domain
authentication, desktop
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.