openid / openid/AppAuth-JS

AuthorizationResponse does not support Implicit flow for RESPONSE_TYPE_TOKEN

Open
#216 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
1k
Forks
165
PR merge metrics
No merged PRs in 30d

Description

Expected Behavior

When using response_type: AuthorizationRequest.RESPONSE_TYPE_TOKEN for implicit flow, the authorization notifier should be invoked with complete response containing the tokens, not just the cherry-picked code and state which are relevant only to authorization code flow.

Describe the problem

The current behaviour assumes that the response payload is for AuthorizationRequest.RESPONSE_TYPE_CODE, and only returns the properties expected for an authorization code flow. When using implicit flow and a successful authorization occurs, the tokens are not sent to the authorization notifier.

AuthorizationResponse also lacks the required properties and appears to only support RESPONSE_TYPE_CODE, despite the requests support for RESPONSE_TYPE_TOKEN.

RESPONSE_TYPE_TOKEN is effectively ignored, despite this being an option and configurable value in AuthorizationRequest.

[REQUIRED] Steps to reproduce the behavior

Following the same code example as the example in the README with the following differences.

  1. Perform an implicit authorization flow with response_type: AuthorizationRequest.RESPONSE_TYPE_TOKEN
  2. Observe the response in the authorization notifier that the tokens are not included in AuthorizationResponse
[REQUIRED] Environment
  • AppAuth-JS version: 1.3.1
  • AppAuth-JS Environment (Node, Browser (UserAgent), ...): Google Chrome, Vue.JS PWA
  • Source code snippts (inline or JSBin)
this.authorizationRequest = new AuthorizationRequest({
  client_id: '~~redacted~~',
  redirect_uri: '~~redacted~~',
  scope: 'openid profile email phone',
  response_type: AuthorizationRequest.RESPONSE_TYPE_TOKEN,
  state: undefined,
  extras: {}
})

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with AuthorizationResponse and the AuthorizationRequest response_type handling, then follow the authorization notifier path described in the README example. Reproduce the implicit flow using RESPONSE_TYPE_TOKEN and compare it with the existing code-flow response. Done means the notifier receives the complete token response rather than only code and state.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.