firebase / firebase/firebase-js-sdk
login_hint should not be deleted from SAML AuthURIs
- Dominant language
- TypeScript
- Stars
- 5.1k
- Forks
- 1k
- Avg merge
- 2d 21h
- Merged PRs (30d)
- 37
Description
### [REQUIRED] Describe your environment
* Operating System version: Windows 10
* Browser version: Firefox 80.0.1 64-bit
* Firebase SDK version: 4.5.2
* Firebase Product: auth
### [REQUIRED] login_hint not appended to SAML AuthURI
#### Steps to reproduce:
Using any SAML provider, supply a login_hint (such as foo@example.com). Note that &login_hint=foo@example.com is not appended to the SAMLRequest URL
#### Relevant Code:
This test is wrong: https://github.com/firebase/firebase-js-sdk/blob/90b5f044b136211a39f891c05788bc46de1d2927/packages/auth/test/rpchandler_test.js#L7984
It is not a violation of the SAML standard to pass along custom parameters
This code is the root cause: https://github.com/firebase/firebase-js-sdk/blob/b73ab41356f5b86a693a0e6c5cdc1a6e9841b8e6/packages/auth/src/rpchandler.js#L1006
Contributor guide
Assessment
This issue has not been assessed yet.