fix: handle url fragments for redirects#4464
Conversation
Signed-off-by: Huub van der Voort <[email protected]>
|
|
||
| <script type="text/javascript"> | ||
| if (window.location.hash) { | ||
| var buttons = document.querySelectorAll('div.theme-form-row a'); |
There was a problem hiding this comment.
| var buttons = document.querySelectorAll('div.theme-form-row a'); | |
| var buttons = document.querySelectorAll('div.theme-form-row a'); |
NIT: Can we make the selector more straightforward? Maybe we can add ID to the password button.
There was a problem hiding this comment.
Do you mean to only change the button that is linking to a password connector, or all connectors? I think this applies to all connectors. Because a press on any provider button will not include the url fragment, if not explicitly injected.
If you want to support all connectors, I can make it more specific by adding a class to the anchor elements "provider-anchor" and update the query selector to a.provider-anchor.
(edit: or maybe better to add an id attribute "providers" to the parent div and then use "#providers a")
Or do you have something else in mind?
There was a problem hiding this comment.
You are selecting div by a class, and I think more about selecting div by id or something.
getElementById('myId') or querySelectorAll('div#myId')
Overview
Includes original URL fragment throughout auth process to keep it in the original redirect.
What this PR does / why we need it
Closes #4462
Including the URL fragment on the pages that do form posts to different URL (not to self) and anchor links to providers.
Special notes for your reviewer
What are implications of adding the hash to the URLs on the login.html page. Do some providers use the hash and if so this will mess up the url fragment. Maybe we should only add it to the password.html page.
Tested manually using the following flow:
./bin/dex serve examples/config-dev.yamlcd examples && go run ./example-apphttp://127.0.0.1:5555/click login#foobarto the URL and force refresh#foobarto the URL and force refresh[email protected]andpasswordand observe the fragment is still there after being redirected.