openid / openid/AppAuth-iOS

Authorization URLQuery parameters are overwritten when the auth request is constructed.

Open
#580 4 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Objective-C
Stars
2k
Forks
867
Avg merge
4d 48m
Merged PRs (30d)
1

Description

I don't know if this behavior is intended, but at least it behaves different compared to the Android version.
Recently I implemented an Azure B2C Login in a flutter app.

The authorizationUrl contains a query parameter which is crucial for the login page to be found. It looks something like this:

"authorization_endpoint": "https://xxxloginUrl.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1a_signinusername".

The important part which gets lost on the way here ist p=b2c_1a_signinusername

On android this was working fine, but on iOS the page was not found. After some debugging I found that the request is handled in the OIDAuthorizationRequest#authorizationRequestURL

In there the whole request for the authorization is constructed and in the end it calls
URLByReplacingQueryInURL which will replace all existing query parameters.

On android this is not happening. We worked around this by adding the query parameter as additionalParameter for now on iOS but it feels strange to me.
Is this working as intended?
This is not the only place where it is handled that way, just the one I stumbled across as far as I can see.
I'm adding the method where this is happening:

(NSURL *)authorizationRequestURL {
  OIDURLQueryComponent *query = [[OIDURLQueryComponent alloc] init];

  // Required parameters.
  [query addParameter:kResponseTypeKey value:_responseType];
  [query addParameter:kClientIDKey value:_clientID];

  // Add any additional parameters the client has specified.
  [query addParameters:_additionalParameters];

  // Add optional parameters, as applicable.
  if (_redirectURL) {
    [query addParameter:kRedirectURLKey value:_redirectURL.absoluteString];
  }
  if (_scope) {
    [query addParameter:kScopeKey value:_scope];
  }
  if (_state) {
    [query addParameter:kStateKey value:_state];
  }
  if (_nonce) {
    [query addParameter:kNonceKey value:_nonce];
  }
  if (_codeChallenge) {
    [query addParameter:kCodeChallengeKey value:_codeChallenge];
  }
  if (_codeChallengeMethod) {
    [query addParameter:kCodeChallengeMethodKey value:_codeChallengeMethod];
  }

  // Construct the URL:
  return [query URLByReplacingQueryInURL:_configuration.authorizationEndpoint];
}

Kind regards

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at OIDAuthorizationRequest#authorizationRequestURL and inspect the URLByReplacingQueryInURL call that uses the authorizationEndpoint. Reproduce the Azure B2C-style endpoint with an existing query parameter such as p=b2c_1a_signinusername, then verify that the constructed authorization URL preserves it while adding the request parameters.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, objective-c
Domain
authentication, mobile
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.