Repository navigation
Release: v0.2.2 - #176
Merged
Merged
Release: v0.2.2#176
Conversation
The spec said "encoded current URL" for /launch and a stale `?resume=1` shape for /sso. Every consumer of `?return=` accepts only a path with one leading slash (the laddr/Emergence convention), so pin the contract to that and note the login page must fully navigate when the return is an API route rather than an SPA route. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Both anonymous SAML paths handed /login an absolute URL. The login page and the OAuth start drop anything that doesn't begin with a single `/`, so Slack's first live "Test configuration" signed the user in and then landed them on `/` instead of resuming the AuthnRequest. Use the resume path itself for SP-initiated SSO and safeReturnPath of the request URL for /launch so channel/redir survive. The absolute-URL helpers had no other callers. Tests previously matched only the `/login?return=` prefix and passed with the bad value; they now decode the return and assert the exact path. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
The SAML resume endpoint lives under /api, which Fastify serves — the SPA's router has no such route and rendered NotFound when the login and account-claim pages navigate()d there after sign-in. Only GitHub OAuth worked, because the API redirects server-side. One shared helper replaces three copy-pasted safeReturn functions and the login page's weaker inline guard (which lacked the `//` check), and uses window.location.assign for /api/ targets. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
fix: SAML sign-in returns are site-relative and reach the resume endpoint
Author
Changelog- fix: SAML sign-in returns are site-relative and reach the resume endpoint [#175] @themightychris |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Slack SSO now completes for members who have to sign in first: the IdP hands
/logina site-relative return and the login page follows it back to the SAML resume endpoint.Improvements