seatsurfing / backend

Seatsurfing Backend
https://seatsurfing.app
GNU General Public License v3.0
128 stars 39 forks source link

Link based booking re-direct doesn't work with oauth2 provider #265

Closed IdanYaffe closed 1 month ago

IdanYaffe commented 1 month ago

Hello,

This great feature doesn't work as expected due to an issue with the auth redirection: https://github.com/seatsurfing/backend/pull/255

Steps to reproduce:

  1. Use a seat booking link
  2. You'll be redirected to authenticate (even if you're authenticated in another browser tab)
  3. After auth, you will be redirected to the main app page instead of the seat booking pop-up
virtualzone commented 1 month ago

@olivierIllogika Can you look into this? Thanks!

olivierIllogika commented 1 month ago

@IdanYaffe can you provide the (domain anonymized):

  1. booking link you're using
  2. login url containing the "redir" parameter
  3. final url you're redirected to (or not) after login

I've seen some weird stuff happening in the admin area editing page when adding spaces. Like duplicates and missing space id. If your bug suddenly disappear, try with a newly created space.

olivierIllogika commented 1 month ago
  1. You'll be redirected to authenticate (even if you're authenticated in another browser tab)

Try to check the "Remember me" box when signing in. This persists the refreshToken to localStorage instead of just sessionStorage which is only scoped to the current tab.

IdanYaffe commented 1 month ago

Thanks for looking into this @olivierIllogika !

One important note that I forgot to mention is that we're using Google workspaces as our SSO provider, so there's actually another redirect to Google as part of the authentication redirect. looks like this is the root cause as the redir works perfectly when logging in using a user & password

  1. https://our_base_url/ui/search?lid=91ce8dc5-1115-4dd5-84cd-a9b0aae34c70&sid=9554e11a-7138-4b91-a5ba-3653559737e3

  2. https://our_base_url/ui/login?redir=%2Fsearch%3Flid%3D91ce8dc5-1115-4dd5-84cd-a9b0aae34c70%26sid%3D9554e11a-7138-4b91-a5ba-3653559737e3 (this has another redirect to Google and from there back to seatsurfing with the callback url)

  3. https://our_base_url/ui/search