awslabs / cognito-at-edge

Serverless authentication solution to protect your website or Amplify application
Apache License 2.0
191 stars 57 forks source link

login redirect with custom state does not work properly #61

Closed dhanabal-sky closed 1 year ago

dhanabal-sky commented 1 year ago

When I access a web page fronted with congnito auth. I'm getting redirected to Cognito login page without any issues. But once I supply the username and password the redirect URL with auth code is resulting in an error (net::ERR_RESPONSE_HEADERS_MULTIPLE_LOCATION) in chrome browser.

Original request to the web page: (faked domain names) https://example.com/movie/mac_11581288?session_token=test&state=ashhftg56HSJxcv

I get redirected to Cognito Login page with state param encoded as below https://example.auth.ap-southeast-2.amazoncognito.com/login?redirect_uri=https://example.com&response_type=code&client_id=1oer36fu8hkpfsnlcdmc9463jg&state=/movie/mac_11581288%3Fsession_token%3Dtest%26state%3Dashhftg56HSJxcv

Once i supply the username,password and press login, the resulting redirection is marked as error by chrome (net::ERR_RESPONSE_HEADERS_MULTIPLE_LOCATION)

https://example.com/?code=07583bb7-c70f-4ae4-8bb6-4d4ba8fe1a4f&state=/movie/mac_11581288?session_token=test&state=ashhftg56HSJxcv

There are two state params which is causing the confusion and I think if this is properly URL encoded, chrome will then be able to redirect without any errors?

image
dhanabal-sky commented 1 year ago

I believe this is core cognito issue. I will raise this with AWS support.

dhanabal-sky commented 1 year ago

Closing this issue as its nothing to do with this npm library.