New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

redirect_uri with a #hash is incorrectly used #39

Open

poef opened this issue Nov 14, 2023 · 1 comment

Member

poef commented Nov 14, 2023 •

edited by Potherca

Loading

If you send a redirect_uri like https://example.com/#foo in authorization_code grant type, the server incorrectly returns the browser to

https://example.com/#foo?code=.... etc

This is actually a bug in the oauth2-server from the league. In the file:

src/Grant/AbstractAuthorizeGrant.php, line 25 - makeRedirectUri()

https://github.com/thephpleague/oauth2-server/blob/0576f3920115d27edf661b70a784702d20f34b13/src/Grant/AbstractAuthorizeGrant.php#L25

the query params are simply appended to the URL, without checking for a #hash

Member Author

poef commented Nov 14, 2023

So after investigating further, the OAuth2 spec explicitly forbids using #hash values in a redirect_uri. This ticket can thus be closed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment