openid / openid/AppAuth-iOS

AuthState callback isn't called if the redirect URI does not end with "/"

Open
#774 2 comments 7 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Objective-C
Stars
2k
Forks
867
Avg merge
4d 48m
Merged PRs (30d)
1

Description

Describe the bug
I developed an app using OpenID Connect (on the Microsoft identity platform) and here is what I noticed: AuthState callback isn't called when the connection succeeds if the redirect URI doesn't end with "/". However, it is called whenever the connection process is interrupted (for example, if the "Cancel" button is tapped).
I finally found a solution when I read this issue comment: https://github.com/openid/AppAuth-iOS/issues/197#issuecomment-597212857. So it seems necessary to add "/" at the end of the redirect URI.

To Reproduce
Clone the example project of AppAuth-iOS and configure it with your own issuer, client ID and redirect URI. The redirect URI must not end with a "/". Launch the project, enter your login and password, and validate the connection. Then it correctly redirects to the app, but the callback isn't called.

Expected behavior
It should call the callback (either raising an error to report it or succeeding).

Environment

  • Device: iPhone 14 (or any other device running iOS 16)
  • OS: iOS 16

Additional context
This bug doesn't exist in the Android library (AppAuth-Android: https://github.com/openid/AppAuth-Android): the callback is always called, even though the redirect URI doesn't end with "/".

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the AppAuth-iOS example project and reproduce the login flow on iOS 16 using a redirect URI without a trailing slash. Trace the redirect handling and AuthState callback path, comparing successful completion with cancellation. Done means the callback is invoked with either success or an error for the non-slash URI.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, objective-c
Domain
authentication, mobile
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.