refactor(oidc): remove non-standard oidc=1 marker param - #3
Merged
Conversation
In standard OIDC authorization-code flow with PKCE, the authorization endpoint redirects an unauthenticated user to the login page carrying only the standard authorization parameters (client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, nonce). The login SPA can detect an OIDC flow from the presence of those standard params, so the bespoke oidc=1 marker is unnecessary. Drop the oidc query param from the login redirect in the worker and the Rust server, and from the oidcSearchSchema/isOidcFlow frontend logic. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The OIDC flow used a bespoke
oidc=1query parameter as a marker to let the login SPA recognize an OIDC authorization. That marker is non-standard: in the standard OIDC authorization-code flow with PKCE, the authorization endpoint redirects an unauthenticated user to the login page carrying only the standard authorization parameters (client_id,redirect_uri,scope,state,code_challenge,code_challenge_method,nonce). The presence of those required parameters is already sufficient to detect an OIDC flow, sooidc=1added no value.Approach
Remove the
oidc=1marker everywhere:crates/beacon-worker/src/wasm/oidc.rs): stop appendingoidc=1in the two unauthenticated/expired redirect branches.crates/beacon/src/handlers/oidc.rs): stop appendingoidc=1inlogin_redirect.src/lib/minecraft-flow.ts): dropoidcfromoidcSearchSchemaand drop theparams.oidc === '1'check fromisOidcFlow.oidcparam.src/router.tsx: updated the comment (the string-preservingparseSearch/stringifySearchfix from fix(ui): keep OIDC query params as strings to fix invalid_value error #2 remains necessary, since OIDC params are strings).Verification
cargo build -p beacon-worker --target wasm32-unknown-unknownpasses (only pre-existing unused-alias warning).beaconserver crate could not be checked locally due to a pre-existing OpenSSL/MSVC environment dependency issue unrelated to this change; the change there is a pure deletion of anappend_pairline.Notes
No compatibility concern: the mod builds the authorize URL itself and never reads the
oidcquery param; the removed param was only read by this frontend's schema. The string-preserving search parsing already merged in #2 is kept.