http redirect - How does Redirection work in Oauth Authorization Code Flow? - Stack Overflow

admin管理员组

文章数量:1299985

I am trying to implement an OAuth Authorization Server but I am confused on how the Authorization Code redirection should work.

The Oauth Client redirects my user to my login page, where they will enter their credentials and if successful, my frontend will move them to an authorize page where on clicking on Authorize button, my frontend calls my backend /authorize endpoint. If the request is validated, my backend sends a 302 Found response with a Location Header containing the redirect url provided by the Oauth Client along with my authorization code.

Now I am confused what happens at this point. I am getting a CORS error at my frontend and the Oauth Client is getting a Preflight Options request at their provided redirect url.

How does the Redirection to the Oauth Client Url work? Does the browser redirect by itself to the new page? Does my frontend need to write the code to redirect here? Why is the CORS issue coming? The Access-Control-Allow-Origin is set to *.

I am trying to implement an OAuth Authorization Server but I am confused on how the Authorization Code redirection should work.

The Oauth Client redirects my user to my login page, where they will enter their credentials and if successful, my frontend will move them to an authorize page where on clicking on Authorize button, my frontend calls my backend /authorize endpoint. If the request is validated, my backend sends a 302 Found response with a Location Header containing the redirect url provided by the Oauth Client along with my authorization code.

Now I am confused what happens at this point. I am getting a CORS error at my frontend and the Oauth Client is getting a Preflight Options request at their provided redirect url.

How does the Redirection to the Oauth Client Url work? Does the browser redirect by itself to the new page? Does my frontend need to write the code to redirect here? Why is the CORS issue coming? The Access-Control-Allow-Origin is set to *.

• http-redirect
• oauth-2.0
• oauth
• cors

Share Improve this question Follow asked Feb 11 at 18:54 DarkHorse1997DarkHorse1997 10311 silver badge66 bronze badges 5

• Your frontend shouldn't "call" the authorization endpoint, it should redirect the user to it, presumably with document.location. It's not an API you call with fetch – Evert Commented Feb 12 at 2:15
• Just to be clear, in this case what I refer to as frontend is the authorize page of my authorization server, something like user-images.githubusercontent/3988879/…. It is not the my Oauth Client's page. – DarkHorse1997 Commented Feb 12 at 5:13
• Yes, redirects are still done by a browser. You shouldn't be parsing Location headers or have CORS issues because they are simple redirects. – Evert Commented Feb 12 at 20:32
• Yes, that's the thing I am confused about. I assumed when my server responds with HTTP 302, it will go to the browser and the browser will automatically redirect to the new URL provided by the Location Header. Instead what I am observing is the browser making an Preflight Options call to the Location Url, and then throwing a CORS error. – DarkHorse1997 Commented Feb 13 at 16:10
• The only reason you would get a preflight is if you programmatically call the /authorize endpoint. You need to actually send the user to that location, not use fetch(). – Evert Commented Feb 13 at 18:25

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

The response from the oauth server can contain a HTML page that auto-submits the data back to the client via the browser. As shown in the picture taken from one of my traning classes below:

This may wary depending on the oauth server. My example is from Duende IdentityServer. In your case it might try to do an Ajax call to do this postback.

Basically, this is a clever way, for the auth server to ask the browser to post a request to the client. Use a tool like Fiddler to explore the requsts made by the browser.

本文标签： http redirectHow does Redirection work in Oauth Authorization Code FlowStack Overflow