Web: No fragment in the OpenID Connect redirect uri allowed

[DeepDiver1975]

According to https://tools.ietf.org/html/rfc6749#section-3.1.2 it is not allowed to have a fragment in the redirect uri.

We need to change this asap to ensure compatibility with any OpenID Connect Providers out there

THX @labkode for the hint

[labkode]

I found the issue thanks to running this certified OpenID server:
https://github.com/ory/hydra/releases

Steps to reproduce:

DATABASE_URL=memory hydra serve --dangerous-force-http all &
# listens on http://0.0.0.0:4445

hydra clients create --endpoint http://0.0.0.0:4445 --id example-app --callbacks 'http://localhost:8000/#/oidc-callback'
Command failed because status code 201 was expected but code 400 was received.

Response payload:

{
        "error": "invalid_request",
        "error_description": "The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed",
        "error_hint": "Redirect URIs must not contain fragments (#)",
        "status_code": 400,
        "request_id": ""
}

[DeepDiver1975]

I see two solutions:

• use a second html file - callback.html which holds all necessary code. url will look like http://phoenix.example.net/calllback.html
• switch vue router mode https://router.vuejs.org/guide/essentials/history-mode.html#html5-history-mode which has a bigger impact and requires server config so that the SPA works properly ..

I'd vote for solution 1 - any objections @tempelgogo @scramb - THX

[DeepDiver1975]

Solution 1 would be basically like this https://github.com/joaojosefilho/vuejsOidcClient/blob/master/static/callback.html

[tempelgogo]

I think we should get rid of this relict in our URLs & switch to History Mode.
I don't like that hash in our URL, anyway.

With little effort we're able to support it in dev mode. You're right that we need to adopt all server config's, but it's essentially just if not static asset, fallback to index.html/$1/ in almost all web servers, because vue-router will handle the url after init.

It's supported within our target platform: https://caniuse.com/#feat=history

[DeepDiver1975]

That damn callback.html approach is hacky as hell :boom:

Let's try to get solution 2 running .... I'll give this a shot tomorrow

[DeepDiver1975]

@labkode while this is not the final solution you could still give #751 a try