Skip to content

Custom state causes error with initImplicitFlow and Microsoft Azure AD B2C #216

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
merken opened this issue Jan 18, 2018 · 2 comments
Closed

Comments

@merken
Copy link

merken commented Jan 18, 2018

Package version 3.1.4

When calling initImplicitFlow(route:string) using Azure B2C OpenId, the state is URL encoded.
This causes issues at the side of Microsoft.

See the generated URI from createLoginUrl :
https://login.microsoftonline.com/merken.onmicrosoft.com/oauth2/v2.0/
authorize?p=b2c_1_mrkn_si&response_type=id_token%20token&client_id=454caa98-b525-4c00-8e01-fc1e7bf477e4&
state=Z6wkN5gVwAozqZNIgaGUg7h1QJKfD4kMcxKyxmkq%3B%2Ftasks&
redirect_uri=https%3A%2F%2Flocalhost%3A3000%2Findex.html&scope=openid%20https%3A%2F%2Fmerken.onmicrosoft.com%2Fauthapp%2Fread_write&nonce=Z6wkN5gVwAozqZNIgaGUg7h1QJKfD4kMcxKyxmkq

The route was '/tasks', as a result %2Ftask is added to the state, the OpenId service fails to login.

Without state, the login succeeds :
https://login.microsoftonline.com/merken.onmicrosoft.com/oauth2/v2.0/
authorize?p=b2c_1_mrkn_si&response_type=id_token%20token&client_id=454caa98-b525-4c00-8e01-fc1e7bf477e4&
state=04iHQ6HqqZMQBqGnHSNkqh6fOTJnptmzuCwwq7kl
&redirect_uri=https%3A%2F%2Flocalhost%3A3000%2Findex.html&scope=openid%20https%3A%2F%2Fmerken.onmicrosoft.com%2Fauthapp%2Fread_write&nonce=04iHQ6HqqZMQBqGnHSNkqh6fOTJnptmzuCwwq7kl

Suggestion: maybe base64 encode the complete payload, this will likely not generate any characters subject to URI encoding.

@TomWeps
Copy link

TomWeps commented Jan 28, 2018

We had a similar problem. The proposed pull request is here: #224

@manfredsteyer
Copy link
Owner

@TomWeps thx for the PR. It's merged and it will land soon.

@merken merken changed the title Custom state causes error with initImplicitFlow and Miscrosoft Azure AD B2C Custom state causes error with initImplicitFlow and Microsoft Azure AD B2C May 14, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants