library inserts &goto=http to url but browser demands &goto=https - Githubissues

IdentityModel / oidc-client-js

OpenID Connect (OIDC) and OAuth2 protocol support for browser-based JavaScript applications

Apache License 2.0

2.43k stars 841 forks source link

library inserts &goto=http to url but browser demands &goto=https #1267

Closed ozknemoy closed 3 years ago

ozknemoy commented 3 years ago

version 1.10.1 and 1.7.0 browser chrome as i said in title, the library construct url with wrong GOTO parameter. i use this config const userManagerSetting = { authority: 'https://rd-auth-test.esphere.ru/openam/oauth2/ediora', ... }; and url looks like https://rd-auth-test.esphere.ru/openam/UI/Login?realm=%2Fediora&goto=http%3A%2F%2Frd-auth-test.esphere.ru%2Fopenam%2Foauth2%2Fediora%2Fauthorize%3Fclient_id%3Doidcapp%26redirect_uri%3Dhttps%253A%252F%252Fedi2-test.esphere.ru%252Flogin-callback%26response_type%3Did_token%2520token%26scope%3Dopenid%2520implied_consent%26state%3Db1f67e7682604eca89b8ae4490df4cb2%26nonce%3Db95037df68554743870334cdc23ed193

and when client go to http://rd-auth-test.esphere.ru/openam/oauth2/ediora/authorize... chrome warns user about security issue

this problem pops up only december 15. 2 year this has been working fine

123