First authorization request produced by OIDC module fails due to inclusion of sessionid #4227

Activity

1. travisspencer commented on Oct 21, 2019

   

   travisspencer

   on Oct 21, 2019

   ContributorAuthor

   More actions

   This is fixed by a small change:

   Index: jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java
   IDEA additional info:
   Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
   <+>UTF-8
   ===================================================================
   --- jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java	(date 1569810226000)
   +++ jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java	(date 1571644743691)
   @@ -399,7 +399,7 @@
                if (LOG.isDebugEnabled())
                    LOG.debug("challenge {}->{}", session.getId(), challengeUri);
                int redirectCode = (baseRequest.getHttpVersion().getVersion() < HttpVersion.HTTP_1_1.getVersion() ? HttpServletResponse.SC_MOVED_TEMPORARILY : HttpServletResponse.SC_SEE_OTHER);
   -            baseResponse.sendRedirect(redirectCode, response.encodeRedirectURL(challengeUri));
   +            baseResponse.sendRedirect(redirectCode, challengeUri);
    
                return Authentication.SEND_CONTINUE;
            }
   

   I'm unsure, but thinking that response.encodeRedirectURL(String) is for internal redirects whereas this is an external one. Could that be? Is that change above the one that's needed? Will it break things in a clustered environment? (I didn't test that; only a single-node setup.)
2. lachlan-roberts commented on Oct 22, 2019

   

   lachlan-roberts

   on Oct 22, 2019

   Member

   More actions

   This is sending the jsessionid in the URL so it can remember the session if cookies aren't being used.

   I tested OpenID with Google and Microsoft and they both do not allow you to authenticate with cookies disabled, and Microsoft gave a 404 response as well for the ;jsessionid=... in the URL.

   So yes, I think the best thing to do is remove response.encodeRedirectURL so we don't add this to the redirect URL.
3. lachlan-roberts

   added 3 commits that reference this issue on Oct 22, 2019

   Issue #4227 - do not use encodeRedirectURL for openid redirects

   ...

   393a8a9

   Issue #4227 - do not use encodeRedirectURL for openid redirects

   ...

   8e8d651

   Issue #4227 - do not use encodeRedirectURL for openid redirects (#4233)

   ...

   a9e543c
4. joakime

   changed the title [-]1st authorization request produced by OIDC module fails due to inclusion of sessionid[/-] [+]First authorization request produced by OIDC module fails due to inclusion of sessionid[/+] on Oct 22, 2019
5. lachlan-roberts

   self-assigned this

   on Oct 23, 2019
6. lachlan-roberts

   closed this as completedon Oct 23, 2019