-
Notifications
You must be signed in to change notification settings - Fork 333
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Doesn't support matrix urls because semicolons get encoded. #104
Comments
Your example url was for the initial request that was lacking credentials and initiated the login flow? In that case then it looks like the encoding issues happen here where it captures the initial url for later use: AspNetKatana/src/Microsoft.Owin.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs Line 127 in a4ad9a8
AspNetKatana/src/Microsoft.Owin.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs Line 51 in a4ad9a8
This has been rewritten for Core and looks more compliant: That would be a lot of code to copy. Workaround: Initiate the login from a dedicated endpoint that does not use urls like this. |
Angular 2 uses matrix urls by default instead of querystrings. Matrix urls use semicolons which are part of the path instead of querystrings.
Example url:
http://localhost:53276/report/balance-sheet-k;locationId=4;year=2017;period=6
Authorization call from OWIN:
https:// login.microsoftonline.com/{guid}/oauth2/authorize?client_id={client id}&response_mode=form_post&response_type=code+id_token&scope=openid+profile&state=OpenIdConnect.AuthenticationProperties%3dt5yyZoleJsYyxRLKoLRd7b9jkuTde73pbhwS0weZ_kxZ7Gnn1owouZBUZ7waDEYjxLxgKetCznfWb-U57ehIKeWlqO_VGIF5QVCgEkqqGl-D9zyWx-w8uomBUeUSvxaVXJTz2Qe8-H-s1N9UOLKEHrflZoIu4NwC-sXmFDWaam5EffkhgjhWcBeU2L5pznLwZTjWhQiWpYlqgO0aq-cpzQ&nonce=636371414679867284.ZDRlNjk5YzUtZWI1MC00NzA1LTk2YzktODIyNGVhNTllOTIzM2Y3NWY5ODUtZjJkNy00NmZlLWFiZTMtYzRjNWI3YjFkNzYz
Redirect url from Microsoft.Owin: http:// localhost:53276/report/balance-sheet-k%3BlocationId%3D4%3Byear%3D2017%3Bperiod%3D6
I think the issue is at
src/Microsoft.Owin.Security.OpenIdConnect/OpenidConnectAuthenticationHandler.cs
line 151 where is calls Uri.EscapeDataString(). Semicolons aren't in the list of unreserved characters so they get encoded.
The text was updated successfully, but these errors were encountered: