How to remember prior-login url?

[lcmgh]

Hi!

From my understanding the only way to let my app redirect the user to the original accessed url (the one prior the oauth redirect) is to encode the path within the redirect_uri when server side storage is not desired.

Is the recommended approach to copy the client and adapt the redirect_uri?

I tried to use add_auth_context_value as an alternative "storage" but type AuthenticationContextClass is private.

Thanks

[ramosbugs]

I'd suggest using the state value to carry arbitrary payload in addition to a CSRF token (e.g., as a base64url-encoded JSON blob). The OIDC provider will include the state you provide in the redirect back to your app, from which you can extract the original URL. Some providers may have a size limitation if the state is very big, in which case you could consider browser storage as an alternative to server-side storage.

[lcmgh]

I'd suggest using the state value to carry arbitrary payload in addition to a CSRF token (e.g., as a base64url-encoded JSON blob). The OIDC provider will include the state you provide in the redirect back to your app, from which you can extract the original URL. Some providers may have a size limitation if the state is very big, in which case you could consider browser storage as an alternative to server-side storage.

That's indeed the cleanest solution.