Skip to content

refactor(oidc): remove non-standard oidc=1 marker param - #3

Merged
Summpot merged 1 commit into
mainfrom
summpot-bookish-system
Aug 6, 2026
Merged

refactor(oidc): remove non-standard oidc=1 marker param#3
Summpot merged 1 commit into
mainfrom
summpot-bookish-system

Conversation

@Summpot

@Summpot Summpot commented Aug 6, 2026

Copy link
Copy Markdown
Owner

Why

The OIDC flow used a bespoke oidc=1 query parameter as a marker to let the login SPA recognize an OIDC authorization. That marker is non-standard: in the standard OIDC authorization-code flow with PKCE, the authorization endpoint redirects an unauthenticated user to the login page carrying only the standard authorization parameters (client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, nonce). The presence of those required parameters is already sufficient to detect an OIDC flow, so oidc=1 added no value.

Approach

Remove the oidc=1 marker everywhere:

  • Worker (crates/beacon-worker/src/wasm/oidc.rs): stop appending oidc=1 in the two unauthenticated/expired redirect branches.
  • Rust server (crates/beacon/src/handlers/oidc.rs): stop appending oidc=1 in login_redirect.
  • Frontend (src/lib/minecraft-flow.ts): drop oidc from oidcSearchSchema and drop the params.oidc === '1' check from isOidcFlow.
  • Login/register links: stop forwarding the removed oidc param.
  • src/router.tsx: updated the comment (the string-preserving parseSearch/stringifySearch fix from fix(ui): keep OIDC query params as strings to fix invalid_value error #2 remains necessary, since OIDC params are strings).

Verification

  • cargo build -p beacon-worker --target wasm32-unknown-unknown passes (only pre-existing unused-alias warning).
  • The beacon server crate could not be checked locally due to a pre-existing OpenSSL/MSVC environment dependency issue unrelated to this change; the change there is a pure deletion of an append_pair line.

Notes

No compatibility concern: the mod builds the authorize URL itself and never reads the oidc query param; the removed param was only read by this frontend's schema. The string-preserving search parsing already merged in #2 is kept.

In standard OIDC authorization-code flow with PKCE, the authorization
endpoint redirects an unauthenticated user to the login page carrying
only the standard authorization parameters (client_id, redirect_uri,
scope, state, code_challenge, code_challenge_method, nonce). The login
SPA can detect an OIDC flow from the presence of those standard params,
so the bespoke oidc=1 marker is unnecessary.

Drop the oidc query param from the login redirect in the worker and the
Rust server, and from the oidcSearchSchema/isOidcFlow frontend logic.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@Summpot
Summpot merged commit 7b1ca73 into main Aug 6, 2026
11 checks passed
@Summpot
Summpot deleted the summpot-bookish-system branch August 6, 2026 09:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant