search

AxaFrance / oidc-client

Light, Secure, Pure Javascript OIDC (Open ID Connect) Client. We provide also a REACT wrapper (compatible NextJS, etc.).
MIT License
572 stars 151 forks source link

Always seeing "Error authentication" in local during first load of the site #1251

Closed pavankjadda closed 6 months ago

pavankjadda commented 6 months ago

Issue and Steps to Reproduce

In my next.js project, I use @axa-fr/react-oidc to integrate with OIDC server. In my local setup, when I first open any webpage, it redirects me to login page and after successful login, it shows "Error authentication" message. I do not see this error when deployed to DEV or PROD

Versions

7.13.12

Screenshots

Screenshot 2023-12-28 at 7 03 09 PM

Expected

The redirection should work as expected

Actual

Says "State not valid" in dev tools and "Error authentication" in UI

pavankjadda commented 6 months ago

After debugging for hours, I figured out the issue. I have custom 404 page that decodes the if URL is encoded and redirects to decoded version. This is designed for application URLs. But it also applying OIDC callback, hence the error. Added exception for OIDC URLs and it fixed the issue.

@guillaume-chervet question. The URL is being coded after authentication. How can we prevent this? For example

  1. User requests url /employee?id=1001
  2. The library redirects to OIDC server login page and users enters credentials
  3. User is being redirected to /employee%3Fid%3D1001

How can I prevent step 3? Is this being done by React Router in the library?

guillaume-chervet commented 6 months ago

Hi @pavankjadda , very sorry for the delay. Did you solve your problem? How did you solve it?

pavankjadda commented 6 months ago

After debugging for hours, I figured out the issue. I have custom 404 page that decodes the if URL is encoded and redirects to decoded version. This is designed for application URLs. But it also applying OIDC callback, hence the error. Added exception for OIDC URLs and it fixed the issue.

After debugging for hours, I figured out the issue. I have custom 404 page that decodes the if URL is encoded and redirects to decoded version. This is designed for application URLs. But it also applying OIDC callback, hence the error. Added exception for OIDC URLs and it fixed the issue.