Authorization URLQuery parameters are overwritten when the auth request is constructed.
Nobody has claimed this yet.
- Dominant language
- Objective-C
- Stars
- 2k
- Forks
- 867
- Avg merge
- 4d 48m
- Merged PRs (30d)
- 1
Description
I don't know if this behavior is intended, but at least it behaves different compared to the Android version.
Recently I implemented an Azure B2C Login in a flutter app.
The authorizationUrl contains a query parameter which is crucial for the login page to be found. It looks something like this:
"authorization_endpoint": "https://xxxloginUrl.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1a_signinusername".
The important part which gets lost on the way here ist p=b2c_1a_signinusername
On android this was working fine, but on iOS the page was not found. After some debugging I found that the request is handled in the OIDAuthorizationRequest#authorizationRequestURL
In there the whole request for the authorization is constructed and in the end it calls
URLByReplacingQueryInURL which will replace all existing query parameters.
On android this is not happening. We worked around this by adding the query parameter as additionalParameter for now on iOS but it feels strange to me.
Is this working as intended?
This is not the only place where it is handled that way, just the one I stumbled across as far as I can see.
I'm adding the method where this is happening:
(NSURL *)authorizationRequestURL {
OIDURLQueryComponent *query = [[OIDURLQueryComponent alloc] init];
// Required parameters.
[query addParameter:kResponseTypeKey value:_responseType];
[query addParameter:kClientIDKey value:_clientID];
// Add any additional parameters the client has specified.
[query addParameters:_additionalParameters];
// Add optional parameters, as applicable.
if (_redirectURL) {
[query addParameter:kRedirectURLKey value:_redirectURL.absoluteString];
}
if (_scope) {
[query addParameter:kScopeKey value:_scope];
}
if (_state) {
[query addParameter:kStateKey value:_state];
}
if (_nonce) {
[query addParameter:kNonceKey value:_nonce];
}
if (_codeChallenge) {
[query addParameter:kCodeChallengeKey value:_codeChallenge];
}
if (_codeChallengeMethod) {
[query addParameter:kCodeChallengeMethodKey value:_codeChallengeMethod];
}
// Construct the URL:
return [query URLByReplacingQueryInURL:_configuration.authorizationEndpoint];
}
Kind regards
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at OIDAuthorizationRequest#authorizationRequestURL and inspect the URLByReplacingQueryInURL call that uses the authorizationEndpoint. Reproduce the Azure B2C-style endpoint with an existing query parameter such as p=b2c_1a_signinusername, then verify that the constructed authorization URL preserves it while adding the request parameters.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ios, objective-c
- Domain
- authentication, mobile
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100