panva / openid-client

OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
MIT License
1.83k stars 392 forks source link

authorizationUrl and passport strategy options incorrectly exploded into query params #167

Closed przemos closed 5 years ago

przemos commented 5 years ago

Hi, just upgraded openid-client lib to 3.0.2.

I've noticed that when options object is passed to passport.authenticate, it is incorrectly attached to the authorizationUrl: passport.authenticate('oidc', { 'scope': 'scopes' 'redirect_uri': 'someUrl`, })(req, res, next);

then url is : https://somehost/authorize?client_id=550bf762-dd80-437c-ac27-1b62d1d4d1bc&scope=somescope&response_type=code&state=60Lg2m9xstUv05fty2PozIS-SFvPQLXk83hqYkhCsAs&options=%5Bobject%20Object%5D

See options query params... it seems options parameters should be merged with defaults and flattened as name-value pairs, but it is attached as query params with tostring instead :(

panva commented 5 years ago

@przemos thank you for the report, this was indeed a regression during the code syntax update and removal of unnecessary _.defaults. I've included a test for the fixed behaviour so that it does not re-appear in the future. This is now released as v3.1.1