RedirectRequestHandler.completeAuthorizationRequest() assumes that queryParams are returned in the hashed portion of the URL

[sandyboon]

Expected Behavior

One should be able to specify whether the query parms 'state' and 'code' are in the hash portion of the URL or in the query string.

Right now, while parsing the query params _this.utils.parse(_this.locationLike, true / use hash /); hard codes the value 'useHash' to true, This should either be an argument to the function completeAuthorizationRequest or to the constructor of the RedirectRequestHandler object.

One should be able to specify whether the query parms 'state' and 'code' are in the hash portion of the URL or in the query string.

While constructing the AuthorizationRequest object, set the response_mode value to 'query'.

const request = new AuthorizationRequest({ client_id: fcAuthConfig.clientId, redirect_uri: ${window.location.origin}${window.location.pathname}, usePkce : true, scope:'openid', response_type: AuthorizationRequest.RESPONSE_TYPE_CODE, extras: {'response_mode': 'query' } }); Perform the authorization request - authorizationHandler.performAuthorizationRequest(authConfig, request); and then await authorizationHandler.completeAuthorizationRequestIfPossible(); after signing in and redirection.

[REQUIRED] Environment

• AppAuth-JS version: 1.3.1
• AppAuth-JS Environment (Node, Browser (UserAgent), ...): Chrome
• Source code snippts (inline or JSBin)

[tikurahul]

You can extend RedirectRequestHandler and ignore useHash.

[thardyman]

e.g. https://github.com/openid/AppAuth-JS/issues/195#issuecomment-953363001