vouch / vouch-proxy

an SSO and OAuth / OIDC login solution for Nginx using the auth_request module
MIT License
2.92k stars 327 forks source link

Vouch Loses Redirect URL upon re-authorization #558

Closed manavkapoor closed 7 months ago

manavkapoor commented 7 months ago

First read the README Specifically Troubleshooting, Support and Feature Requests.

And please turn on vouch.testing before you ask for support.

Please DO NOT post config and logs to this issue, use a Gist gist

Describe the problem A clear and concise description of the behavior you are observing. Please include which OAuth provider you are using. Hi, I'm using Okta as my OAuth provider. Currently, we are using vouch proxy to front Kibana which has been working great. However, it seems that upon re-authentication with Okta (when a cookie expires), the redirect url isn't properly persisted and users are redirected to the Kibana homepage where they lose their original query (which is found in the query string). I've done some deep digging and it seems that okta doesn't support dynamic urls due to security reasons and encourages using the state keyword to pass a jwt which has the encoded url and then decode that jwt to redirect the user to their original url. I've tried this implementation but it doesn't seem to be working. I wanted to see if this is an issue that vouch has tackled or if there are any actual workarounds to resolving this issue.

Expected behavior A clear and concise description of what you expected to happen. In an ideal state, we expect users who share a url to be able to open that url with the full query string preserved even upon re-authentication. Currently, it drops the query string.

Desktop (please complete the following information):

Smartphone (please complete the following information):

Additional context Add any other context about the problem here.

bnfinet commented 7 months ago

This is pretty good...

https://stackoverflow.com/questions/55524480/should-dynamic-query-parameters-be-present-in-the-redirection-uri-for-an-oauth2/55577647#55577647

Yes, the redirect URL must be static for security reasons.

After you've authenticated you should be able to use the back button, usually by clicking a few times, to get back to your previous Kibana dashboard.