RestorePreviousSession redirects to the wrong page

Search terms you've used

• redirect

Impacted package

Which packages do you think might be impacted by the bug ?

• solid-client-authn-browser

Bug description

It is not possible to navigate to the page where the restorePreviousSession prop has been set to true. But for all the other pages the session is restored automatically without setting the prop to true.
I expected that setting the flag would lead to an automatic redirect when navigating to a new page which partially happens. But, in one corner case, it not only restores the session but also redirects to the previous (wrong) page.

To Reproduce

1. Checkout the restorePreviousSession branch: https://github.com/FUUbi/solid-client-authn-js/tree/f5cea590f610508347d968e29c49003bca7ed25f/packages/browser/examples/single/script (let me know if I should send a PR)

I extended the single browser example to have three different HTML-Pages.

On Page-B, I set the redirect prop to true:

 session.handleIncomingRedirect({
   url:window.location.href,
   restorePreviousSession: true                
})

But for A and B, the default value (false) is used.

session .handleIncomingRedirect(window.location.href)

So now what happens is that if we visit A first, it is impossible to reach B.

from	to	result
A	B	A
A	C	C
C	B	C
C	A	A

If we clear the state and visit B first. We can reach it, but then after seeing A or C
we always get redirected to the previous state.

from	to	result
B	A	A
A	B	A

Expected result

I would expect that setting the restore flag is necessary on every page I want the session to be restored automatically. But not go back to the previous (one step back in the page history) page.

Additional Information

This bug hunt was quite an adventure as I experienced bizarre redirect behaviors.
I quickly went through the source code and tried to set the redirect URL by the window reference. But that leads to a Uri mismatch.

{"error":"invalid_request","error_description":"Mismatching redirect uri"}

Unfortunately, I don't have the resources currently to look into it in greater detail, but I hope this gets fixed soon.

Start by reproducing the redirect matrix in packages/browser/examples/single/script using handleIncomingRedirect with and without restorePreviousSession. Compare navigation from pages A, B, and C and trace how the previous page is selected. Done means session restoration no longer redirects to the wrong page while the expected automatic restoration behavior remains intact.