supertokens / supertokens-node

Node SDK for SuperTokens core
https://supertokens.com
Other
292 stars 79 forks source link

Supertokens seems to convert OIDC discovery URLs to lower case which cause the IDP to return a 404 #789

Open kgomes opened 8 months ago

kgomes commented 8 months ago

🐛 Bug Report I am using a NodeJS backend and using the ThirdPartyEmailPassword recipe. We use Cisco Duo which has an OIDC discovery endpoint. The OIDC endpoint is case-senstive and it appears that the SuperTokens SDK converts all the characters in the URL to lower case which causes the IDP to return a 404 to the Supertokens SDK.

Useful informations It pretty easy to repeat as I can take the OIDC url and use curl and it works fine. When I turn on debug messages on the supertokens node module, it spits out the URL it tries to use to get to the OIDC endpoint. The URL that shows up in the log is all lower case and If I take that URL directly and run curl with it, I also get a 404. The solution would be to not convert everything to lower case (or at least have an option to disable that).