the "originalUrl" is not used as the default "returnTo" url, the baseUrl is

[jordanst3wart]

Checklist

• The issue can be reproduced in the express-openid-connect sample app (or N/A).
• I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
• I have looked into the API documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

The baseUrl is used as the returnTo value as a default, when it should be the "originalUrl" the request came from.

The error is here. It should use returnTo if defined or originalUrl:

express-openid-connect/middleware/auth.js

Line 42 in 1d33b74

res.oidc.login({ returnTo: config.baseURL })

This is a regression of this fix:
#95

I believe the originalUrl is the "referrer" header in the Get login request.

Reproduction

Try logging into an application. The state should include a returnTo value of the baseUrl, and not the original url the request was from.

Additional context

No response

express-openid-connect version

any v2 version

Express version

any

Node.js version

any

[adamjmcgrath]

Hi @jordanst3wart - thanks for raising this

This behaviour is as designed, we don't use the referrer header in the returnTo by default because the referrer header can be a third party (eg if google linked to your login page, you would return to google after login) - if you want this behaviour you can override the default login route behaviour, see https://github.com/auth0/express-openid-connect/blob/master/EXAMPLES.md#3-route-customization

The baseUrl is used as the returnTo value as a default, when it should be the "originalUrl" the request came from.
The error is here. It should use returnTo if defined or originalUrl:

originalUrl in this instance is the /login route - so if you returned to that page after login you would be stuck in an infinite loop

This is a regression of this fix: #95

There is no regression, this behaviour works as designed. When you protect a route with requiresAuth - you will be returned to that route after login (this is the behaviour that was fixed in #95) see https://github.com/auth0/express-openid-connect/blob/master/EXAMPLES.md#2-require-authentication-for-specific-routes

[jordanst3wart]

Yeah, the number 2. sample works as expected.

Thanks for your time! Closing