auth0 / passport-wsfed-saml2

passport strategy for both WS-fed and SAML2 protocol
MIT License
48 stars 62 forks source link

[ULP-3649][ULP-3712] Fix: URL fragments in SAML Sign in URLs #171

Closed ganeshrajsekar closed 2 years ago

ganeshrajsekar commented 2 years ago

Description

Purpose: This PR solves an existing bug in SAML request URL construction during sign in. If the URL contains any fragments, the fragments are not always appended at the end of the URL after all the query params.

Eg: When parsing https://example.com/#Test.

The PR solves the problem by stripping fragments and query from URL and then appending them in the correct order after parsing stage.

References

ESD Ticket: https://auth0team.atlassian.net/browse/ESD-19892 for more context

Testing

Added Unit tests for this fix covering typical URL examples with/without fragments & with/without query params

Checklist