authgear / authgear/authgear-server

"Abort" in Auth Flow API

Open
#3,477 0 comments 0 reactions 0 assignees View on GitHub
bug/minor
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

Sometimes in the UI, we want to provide a button for the user to abort the auth flow instead of dismissing the webpage.
This helps the client app distinguish the abortion from other scenario where the auth flow is not completed.

In the case of #3469, in some cases, the reauth flow is initiated while the user have no matching authenticator to complete the reauth.
A better UX would be put a button under the error message in the UI, so the user can redirect back to the client app instead of closing the browser.

The auth flow API should abort with error.

> Currently we do not support aborting an authentication flow.
>
> 1. The `finish_redirect_uri` (which is `/oauth2/content`) always expect authentication info. We do not support redirect back to `/oauth2/content` with an error generated by the client of authentication flow API.
> 2. The `finish_redirect_uri` is only present when the flow finishes. The client never know what URI they should use to abort the flow.
>
> \_Originally posted by @louischan-oursky in [https://github.com/authgear/authgear-server/issues/3469#issuecomment-1803120119\_]()

Contributor guide

Open the contributing guide

Research direction

Start by tracing the authentication flow API around finish_redirect_uri (/oauth2/content) and the reauthentication scenario described in #3469. Clarify how a client signals abort and how the flow returns an error instead of authentication info. Done means the client can redirect back to its app after aborting rather than closing the browser.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, authentication
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.