auth0 / auth0-vue

Auth0 authentication SDK for Vue.js apps
Other
140 stars 27 forks source link

URL is trimmed to '/' during handleRedirectCallback() invoke #424

Open IliyanRuskov opened 1 month ago

IliyanRuskov commented 1 month ago

Checklist

Description

I would like to report a corner case issue in auth0 library. When an app is served in a subdirectory like /subdir/ the app URL becomes https://<domain>/subdir/. I noticed that in __checkSession() function in plugin.ts the URL is trimmed to '/' using window.history.replaceState(...) which trims the URL to https://<domain>/. After that the router cannot route to the path specified in appState because there's no app on that URL. I think more flexible URL handling is needed like (e.g., exposing the replaceState behavior as a configurable option).

Reproduction

  1. Setup a sample app that is not served at root but at subdirectory so the starting point of the app should become https://<domain>/<subdir>/
  2. Configure Auth0 authentication using Universal Login and set appState: {target: to.fullPath}
  3. After successful authentication the Auth0 redirects back to the app and the url is trimmed and app never goes to appState path.

Additional context

No response

auth0-vue version

2.3.3

Vue version

3.4.37

Which browsers have you tested in?

Chrome