Polytechnique-org / xorgauth

Polytechnique.org Authentication / Authorization provider
GNU Affero General Public License v3.0
1 stars 5 forks source link

Work around invalid AX OIDC queries #153

Closed rbarrois closed 11 months ago

rbarrois commented 11 months ago

Alumnforce performs HTML escaping on the OIDC authorization query. This is invalid, and refused by compliant implementations of OIDC.

Until that is fixed, silently replace '&' with '&' in their query.

NB: If they perform HTML escaping on other parameters of the URL, this middleware will have to be updated.