Changeset bf72108 in Klonkt for src/routes/oauth.js


Ignore:
Timestamp:
07/19/2026 04:04:25 AM (7 weeks ago)
Author:
Robin <roboburr@…>
Branches:
main
Children:
4407c67
Parents:
dd568e7
git-author:
Robin <roboburr@…> (07/19/2026 04:04:05 AM)
git-committer:
Robin <roboburr@…> (07/19/2026 04:04:25 AM)
Message:

Fix: OAuth consent hands off to native apps via an interstitial

After Allow/Deny the server 302-redirected to the client's redirect_uri. For a
native custom scheme (com.klonkt.shaer:/oauth) that 302 is silently dropped by
mobile browsers (no user gesture to launch an external app), so Allow/Deny
appeared to do nothing. finishRedirect() now keeps the 302 for http/https
clients but, for a non-http redirect_uri, serves a tiny interstitial that
meta/JS auto-forwards AND shows an 'Open the app' tap link — a tap is the user
gesture Android needs, and iOS's ASWebAuthenticationSession intercepts either
navigation. Used for both allow (code) and deny/error. Verified: native →
interstitial HTML with the code + tap link; https → still 302; deny → error in
the interstitial. 80 tests green.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:
1 edited

Legend:

Unmodified
Added
Removed

  • src/routes/oauth.js

    rdd568e7 rbf72108  
    4545}
    4646
     47// Hand control back to the client at redirect_uri + params. For a web client
     48// (http/https) a plain 302 is right. For a NATIVE custom scheme
     49// (com.klonkt.shaer:/oauth) a 302 is unreliable: mobile browsers routinely drop
     50// a server redirect to a custom scheme (no user gesture). So we serve a tiny
     51// interstitial that both auto-forwards AND offers a tap link — a tap is a user
     52// gesture that launches the app on Android, and iOS's ASWebAuthenticationSession
     53// intercepts either navigation. Same page for allow and deny (neutral copy).
     54function finishRedirect(res, redirectUri, params) {
     55  const target = redirectWith(redirectUri, params);
     56  if (/^https?:\/\//i.test(redirectUri)) return res.redirect(target);
     57  const attr = target.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');
     58  return res.type('html').send(`<!doctype html>
     59<html lang="en"><head><meta charset="utf-8">
     60<meta name="viewport" content="width=device-width,initial-scale=1">
     61<meta http-equiv="refresh" content="0;url=${attr}">
     62<title>Return to the app</title>
     63<style>body{font-family:system-ui,-apple-system,sans-serif;background:#111;color:#eee;margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;text-align:center}
     64.box{padding:1.5rem}p{color:#aaa;line-height:1.5}a.btn{display:inline-block;margin-top:1.2rem;padding:.85rem 1.7rem;border-radius:12px;background:#5A32E6;color:#fff;text-decoration:none;font-weight:700}</style>
     65</head><body><div class="box">
     66<p>Almost done. If the app doesn't open by itself:</p>
     67<a class="btn" href="${attr}">Open the app</a>
     68</div>
     69<script>location.replace(${JSON.stringify(target)});</script>
     70</body></html>`);
     71}
     72
    4773// Bounce back to the client with an OAuth error (RFC 6749 §4.1.2.1) when we have
    4874// a validated redirect_uri; otherwise render a plain error (open-redirect guard).
    4975function authError(res, redirectUri, state, error, desc) {
    50   if (redirectUri) return res.redirect(redirectWith(redirectUri, { error, error_description: desc, state }));
     76  if (redirectUri) return finishRedirect(res, redirectUri, { error, error_description: desc, state });
    5177  return res.status(400).json({ error, error_description: desc });
    5278}
    … …  
    111137  });
    112138  if (out.error) return authError(res, redirect_uri, state, out.error, out.error_description);
    113   return res.redirect(redirectWith(redirect_uri, { code: out.code, state }));
     139  return finishRedirect(res, redirect_uri, { code: out.code, state });
    114140});
    115141
Note: See TracChangeset for help on using the changeset viewer.