fedora-infra/flask-oidc

OIDC_CALLBACK_ROUTE isn't relative to app root

Closed this issue · 1 comments

russau commented

OIDC_CALLBACK_ROUTE is deprecated so I don't know if there's active dev on the feature. Anyways, here's something I just spotted. URLs are getting built that don't consider an application root.

If I configure a OIDC_CALLBACK_ROUTE of /authorization-code/callback. In views.py a redirect URL of "https://mysite.dev/authorization-code/callback" is getting built. But my site is hosted under a prefix of /banana. So users are redirected to a route that doesn't exist on my site.

f"https://{request.host}{current_app.config['OIDC_CALLBACK_ROUTE']}"

If I update the OIDC_CALLBACK_ROUTE to include the root_path, i.e. /banana/authorization-code/callback. Then the code below is used to configure the route doesn't work because it shouldn't include the prefix.

if app.config["OIDC_CALLBACK_ROUTE"]:
app.route(app.config["OIDC_CALLBACK_ROUTE"])(legacy_oidc_callback)

I think it could be fixed by building the URL using request.url_root (would need something to do the switch to https also), i.e.:

redirect_uri = (
    f`{request.url_root}{current_app.config['OIDC_CALLBACK_ROUTE']}"
)

Hi! Could you try with a more recent version of flask-oidc? I think it's handled now.