You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Preserve original redirect_uri hash fragment when parsing authentication response #28
Refactor browser-util.js / clearHashFragment() to preserve the original hash fragment while clearing out oidc-related hash fragment parameters.
For example, user requests the page https://example.com/resource#someHashFragment, and initiates a WebID-OIDC login flow.
The client will send redirect_uri=https://example.com/resource#someHashFragment as part of its implicit authorization flow. On the return step, the user's browser will be redirected back to the redirect_uri with additional credentials and auth-related parameters. It will be 302 redirected to: https://example.com/resource#someHashFragment&id_token=...&state=... etc.
In currentSession(), when parsing the response and clearing the hash fragment of the uri, only the following hash fragment params need to be cleared out (see OIDC ImplicitAuthResponse):
id_token
access_token
state
token_type
expires_in
So that the resulting cleared uri should be https://example.com/resource#someHashFragment.
Activity