YCloudYUSA / yusaopeny_gated_content

Y USA Virtual YMCA
https://ds.ymca.org
GNU General Public License v3.0
2 stars 8 forks source link

Attempting sign-in to a non-prod copy of a Virtual Y site using Daxko SSO overwrites the valid_redirect_uri #20

Open TomScarboroughYMCA opened 1 year ago

TomScarboroughYMCA commented 1 year ago

Discovered while validating the copy of the West Cook YMCA Virtual Y site (https://westcookymca.y.org) available at https://prelive-westcookymca.y.org, there is a line of code at https://github.com/ymcatwincities/daxko_sso/blob/master/src/DaxkoSSOClient.php#L184 that will overwrite the correct production valid_redirect_uris value with the value from this non-production copy. This operation needs to instead append this address to the valid_redirect_uri list and not overwrite.

Without this code change, further tests of prelive- or similar non-prod copies of Daxko SSO VY sites will cause the production site to experience this error instead of redirecting to the Daxko SSO sign-in page:

CONFIGURATION ERROR: The value used as the 'redirect_uri' URL parameter is invalid because it is not an exact match against Daxko's white list of valid redirect uris. For more information, see: https://api.daxko.com/v3/docs/tutorials/member_authentication/index.html

shelleygoetz commented 1 year ago

Link to Jira ticket: https://yusa.atlassian.net/browse/DS-275