sergiodxa / remix-auth-oauth2

A OAuth2Strategy for Remix Auth
https://sergiodxa.github.io/remix-auth-oauth2/
MIT License
150 stars 56 forks source link

Error when authorization redirect uses same domain as Remix app #97

Closed remmycat closed 2 months ago

remmycat commented 2 months ago

Hey there, thank you for developing the oauth2 auth strategy!

We ran into an issue, because the oauth provider we're trying to redirect to is running on the same domain as the Remix app.

The Remix app is served at / The oauth provider (Keycloak) is served at /login. This is probably not a common setup, but we cannot change it at the moment.

Using the library is currently causing issues, because when remix-auth-oauth2 is throwing the redirect, Remix tries to do a client side navigation, which errors, because we don't have a /login route.

It looks like this can be avoided by throwing redirectDocument(...) instead of redirect(...), to force a hard reload when redirecting, as described in the remix docs. Do you think remix-auth-oauth2 could switch to redirectDocument per default, or does that not make sense for the project? It should be a drop-in replacement.

The only other workaround for us I can think of is to set the magic X-Remix-Reload-Document header on the response ourselves (after catching it), which I'd like to avoid, as it seems to be an implementation detail. Or to fork remix-auth-oauth2 of course.

sergiodxa commented 2 months ago

You can add reloadDocument to the Link or Form triggering the request to the action.

remmycat commented 2 months ago

Ahh, I totally missed that the redirect is still the response to the form submission, and that it might be controllable from that side.

Thanks a lot, this fixed the issue for us!