fix: harden OIDC auth without breaking existing configs - #406
fix: harden OIDC auth without breaking existing configs#406igoroctaviano wants to merge 4 commits into
Conversation
Migrate to oidc-client-ts with auth-code+PKCE by default while keeping grantType: "implicit" working unchanged. Restore deep links via OIDC state, add silent renew, and recover from 401 without dropping the route.
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Aug 3, 2026 2:15p.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
|
Visit the preview URL for this PR (updated for commit 6d10814): https://idc-external-006--pr406-feat-oidc-auth-harde-0za8mqbo.web.app (expires Mon, 10 Aug 2026 14:18:22 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: 88aacecd98ba54d2f9c8d201a9444e43d1ad8307 |
Drop the oidc-client-ts migration that broke grantType: "implicit". Retain state-based deep-link restore, safer 401 renew, and silent renew via the existing redirect_uri with an iframe bootstrap path.
Keep the interactive reauth guard set after IdP redirect starts so concurrent 401s cannot overwrite OIDC state, and remount routed views after silent renew so failed requests refetch with the new token.
Detect IdP error callbacks (e.g. login_required) as renew iframe responses and skip React mount so the iframe cannot corrupt parent OIDC sessionStorage during interactive re-auth fallback.
|
1 participant
Summary
oidc-clientstack so current public configs (includinggrantType: "implicit") keep working with no config or IdP redirect URI changes.stateparameter (removes brittleslim_path/slim_searchlocalStorage). Warm sessions no longer re-apply a stale return URL.login_required) complete inindex.tsxand never mount the React SPA, so they cannot corrupt parent OIDC sessionStorage.endSessionEndpoint(local session clear fallback).isSafeReturnUrl/isOidcAuthorizeCallbackUrlhelpers with unit tests.Compatibility / non-regression
oidc-client@^1.11.5(notoidc-client-ts).public/config/*.jsunchanged; implicit and code response types both supported as before.oidc-client-tsmigration intentionally deferred (would break implicit deployments).Test plan
grantType: "implicit"), open a deep study URL, log in, and confirm you return to the same study (not/)./and confirm you are not redirected to a previous study URL.login_required), interactive login restores the current route; the renew iframe must not boot Slim; concurrent 401s should not start multiple IdP redirects.endSessionEndpoint.public/config/*.jsfiles are unchanged.