redirect behavior change between v1.8.5 and v1.9.x

[simpleway]

Describe the bug
The /oauth2/auth changed redirect behavior between v1.8.5 and v1.9.x. If the URLS_LOGIN is an angular UI app that contains /#/ e.g. http://localhost:3000/#/oauth/login
In v1.8.5, /oauth/auth endpoint redirects to "http://localhost:3000/?login_challenge=48ef86fa7f8142099aacbd172628f708#/oauth/login"
However, in v1.9.2 /oauth/auth endpoint redirects to "http://localhost:3000/%23/oauth/login?login_challenge=48ef86fa7f8142099aacbd172628f708"

Reproducing the bug

Steps to reproduce the behavior:

1. start local hydra server

#!/bin/sh
 
export URLS_LOGIN=http://localhost:3000/#/oauth/login
export URLS_CONSENT=http://localhost:3000/#/oauth/consent
export DSN=memory
export OIDC_SUBJECT_IDENTIFIERS_SUPPORTED_TYPES=public
export SERVE_COOKIES_SAME_SITE_MODE=Lax
export OAUTH2_EXPOSE_INTERNAL_ERRORS=true
export LOG_LEAK_SENSITIVE_VALUES=true
export LOG_LEVEL=debug
 
echo "Starting Hydra ..."
hydra serve all --dangerous-force-http

2. Create a client with

curl -L -X POST 'http://localhost:4445/clients' \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
--data-raw '{
    "client_id": "demo",
    "client_secret": "password",
    "redirect_uris": [
        "http://localhost:8080/callback",
        "https://oauth.pstmn.io/v1/callback"
    ],
    "grant_types": [
        "authorization_code"
    ]
 }'

3. Initiate authorization code flow with

curl -L -X GET 'http://localhost:4444/oauth2/auth?response_type=code&state=123456&client_id=demo&redirect_uri=https%3A%2F%2Foauth.pstmn.io%2Fv1%2Fcallback'

The response header "Location" value is http://localhost:3000/%23/oauth/login?login_challenge=48ef86fa7f8142099aacbd172628f708

Server logs

No error

Server configuration

None

Expected behavior

Expect the redirect behavior remains compatible to v1.8.5 http://localhost:3000/?login_challenge=48ef86fa7f8142099aacbd172628f708#/oauth/login. So the angular login UI can remain functional after upgrade post v1.8.5.

Environment

• Version: v1.9.2
  Git Hash: f0580e2
  Build Time: 2021-01-29T15:02:55Z
• Environment: Debian, Windows

[aeneasr]

Thank you for the report - how are you communicating with hydra's login and consent endpoints? Through the Angular AJAX?

[simpleway]

Angular UI will do some processing, and pass the login_challenge to backend service. The backend service will call hydra login and consent endpoints.

[aeneasr]

Ok good :) Just wanted to make sure!

The problem is probably how we construct the query. In the past, we just appended the query. Now we parse the URL and use RawQuery to construct it properly. I think the error comes from there as the url and query parser does not respect the hashbang URLs.

Generally, we don't want to be too favorable to SPAs due to the risk of people using AJAX to communicate with Ory Hydra admin. However, I do understand that this sucks for specific use cases where this is wanted.

I would be fine with fixing this behavior to resolve your issue. Would you be up for a PR?