OAuth2 Authorization Code flow does not capture code from fragment param
- Dominant language
- TypeScript
- Stars
- 40k
- Forks
- 2.4k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 61
Description
### Expected Behavior
A code flow resulting in an `#code=...` should result in a successful OAuth2 token acquisition, when a `REDIRECT URL` is set, even if the actual cannot be navigated to (for example to an [Application URI Scheme](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/aa767914(v=vs.85)?redirectedfrom=MSDN): `my-application://oauth2`)
Alternatively this could also be a feature request to allow defining '[response_mode](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow#request-an-authorization-code)' as part of the OAuth2 Advanced Options, but I'm not sure if this would fix the issue, depending on if the 'broken' final navigation to the redirect is the issue or if it's the fragment param.
### Actual Behavior
The login window asks which application should be used to open the URL and then stays open on a blank page, without any result.
Inspecting the network OAuth DevTools shows a 302 response with `#code=...` Location header.
### Reproduction Steps
Prerequisite: the identity provider
1. Click on Auth Tab
2. Select OAuth 2.0
3. Ensure Enabled is checked
4. Grant Type :: Authorization Code
5. Authorization URL :: is set
6. Access Token URL :: is set
7. Client ID :: is set
8. Client Secret :: is set
9. **Redirect URL :: is set to an URL with an Application URI Scheme**
10. Click Fetch Tokens
### Is there an existing issue for this?
- [X] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.
### Additional Information
Potentially related to changes in https://github.com/Kong/insomnia/pull/5763
I'm happy to take a jab at the issue myself :)
### Insomnia Version
2023.5.7
### What operating system are you using?
Windows
### Operating System Version
Win 10 22H2
### Installation method
chocolatey
### Last Known Working Insomnia version
_No response_
Contributor guide
Research direction
Start with the OAuth 2.0 Authorization Code flow in the Auth Tab and compare the behavior with the changes in pull request #5763. Reproduce the Windows application-URI redirect case, then verify that a callback URL containing a fragment code completes token acquisition instead of leaving the login window blank.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- electron, typescript
- Domain
- authentication, desktop
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100