openid / openid/AppAuth-iOS

OIDURLQueryComponent does not support fragment

Open
#347 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

out-of-scope
Dominant language
Objective-C
Stars
2k
Forks
867
Avg merge
4d 48m
Merged PRs (30d)
1

Description

Describe the bug
OIDURLQueryComponent does not support parsing fragment in redirect URL. Not all OIDC server by default use query parameters or may not allow query parameters or may not allow request_mode=query. The API presume we always get token as URL query params by default which is incorrect. I am working with OIDC server that does not allow changing request_mode=query and by default use URL fragment instead.

To Reproduce
OIDC server use fragment/hash to return token/code in redirecturl
Example:
org.test://app#code=xxx&nonce=akdfjasd

Expected behavior
response_mode=fragment is not supported and no useful error returned.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

  • OS: iOS
  • Safari
  • master

Smartphone (please complete the following information):

  • Device: iPad Pro
  • OS: iOS12
  • Safari
  • master

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with OIDURLQueryComponent and trace how redirect URLs are parsed for query parameters. Reproduce the fragment-form redirect shown in the issue, then verify that fragment responses are handled and that unsupported response modes produce a useful error.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, objective-c
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.