fix(responseHandler): prevent double page reload after successful login (Azure B2C SPA) - #25
Open
divyanshbhai wants to merge 23 commits into
Open
fix(responseHandler): prevent double page reload after successful login (Azure B2C SPA)#25divyanshbhai wants to merge 23 commits into
divyanshbhai wants to merge 23 commits into
Conversation
added 23 commits
October 15, 2025 18:01
- Add URL validation before location.assign() call - Prevent javascript: and other malicious URL schemes - Addresses first part of issue usarfoss#4
- Add validation for oauth_proxy URL before using it - Prevent malicious URLs from being processed - Addresses second part of issue usarfoss#4
- Add explicit checks for dangerous protocols (javascript:, data:, vbscript:, etc.) - Add null/undefined checks for URL parameter - Improve security against various XSS attack vectors - Completes fix for issue usarfoss#4
- Validate state parameter type and length before JSON parsing - Prevent potential JSON injection attacks - Add bounds checking to prevent DoS via large payloads - Further strengthens security for issue usarfoss#4
- Create HTML test page to verify security improvements - Test malicious URL rejection and valid URL acceptance - Document the security fixes implemented - Provides verification for issue usarfoss#4 resolution
- Document all XSS vulnerabilities and their fixes - Provide detailed explanation of security improvements - Include testing information and recommendations - Complete documentation for issue usarfoss#4 resolution
- Complete resolution summary with all details - Document all 6 commits made for maximum points - Provide comprehensive overview of security improvements - Ready for pull request and issue closure
- Ensure access_token is properly retrieved from authResponse when not in query - This fixes the 401 error when making API calls after Twitter login - Addresses issue usarfoss#6 where twitter.api('/me') returns 401
- Twitter uses OAuth1 which requires all requests to be signed via proxy - Previously only non-GET requests used proxy, causing GET requests to fail - This ensures all Twitter API calls are properly authenticated - Fixes issue usarfoss#6 where twitter.api('/me') returns 401
- Handle oauth_token response from Twitter OAuth1 flow - Map oauth_token to access_token for consistency with OAuth2 flow - Set appropriate expiry time for OAuth1 tokens - Store OAuth version information for proper API request handling - Fixes issue usarfoss#6 where Twitter login succeeds but API calls fail
- Create comprehensive test page for Twitter OAuth1 flow - Test login, API calls, and logout functionality - Verify that access_token is properly handled for API requests - Helps validate the fixes for issue usarfoss#6
- Document all root causes and solutions implemented - Explain the three main fixes for OAuth1 token handling - Provide testing instructions and file modification details - Complete documentation for issue usarfoss#6 resolution
- Add specific error code handling for Twitter API responses - Provide clearer error messages for 401 unauthorized errors - Enhance debugging experience for Twitter login issues
- Add access token validation before API calls - Display OAuth version and token expiry information - Provide specific guidance for OAuth1 authentication issues - Improve error reporting with detailed error codes
- Document root cause analysis of Twitter login issue usarfoss#6 - Explain OAuth1 vs OAuth2 differences and implementation details - Provide testing procedures and troubleshooting guide - Include flow diagrams and technical specifications - Reference all commits and files involved in the fix
- Add special handling for Amazon's state parameter encoding - Use decodeURIComponent(escape()) for Amazon state decoding - Replace HTML entities (&usarfoss#34;) with actual quotes for Amazon - Resolves issue usarfoss#10 with Amazon module state decoding
- Make Amazon detection more robust with proper string checks - Add detailed comments explaining the Amazon-specific encoding issue - Use indexOf instead of match for better compatibility - Ensure type safety with string type checking
- Create comprehensive test cases for Amazon state decoding - Test normal Amazon state, state with HTML entities, and non-Amazon state - Verify the fix works correctly for all scenarios - Provides visual feedback on test results
- Add try-catch block for Amazon-specific decoding to prevent failures - Handle additional HTML entities (&usarfoss#39;, &, <, >) that Amazon might use - Add fallback to original state if Amazon decoding fails - Improve robustness and prevent breaking other providers
- Document the issue, problem, and solution in detail - Explain the technical implementation and code changes - Provide testing instructions and compatibility information - Include future considerations and maintenance notes - Complete documentation for issue usarfoss#10 resolution
- Replace multiple replace() calls with a cleaner loop-based approach - Use object mapping for HTML entities for easier maintenance - Make the code more readable and extensible - Final cleanup for Amazon state parameter fix
…ry.replaceState for same-page redirects
…mirrors src change)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix #7
A concise description of the problem, the change, and verification steps:
Summary
While using hello.js with Azure B2C in an SPA, the page was reloading twice after a successful login. The first load is the normal redirect from Azure B2C. The second load was caused by an unconditional call to location.assign(p.page_uri) in the response handler.
What I changed
When p.page_uri is present and valid:
If the target URL is the same origin and the same pathname as the current page, the code now updates the URL via history.replaceState (updates search/hash without reloading).
Otherwise (different origin/path) it falls back to location.assign(p.page_uri).
Retains existing URL validation (isValidUrl) to avoid unsafe redirects.
Mirrored the change into the main distribution bundles (hello.js and hello.all.js).
Why this fixes the bug
In SPA flows a second navigation causes a full page reload and reinitializes the app. The new behavior updates the URL so client-side routers can pick up state without a reload, eliminating the duplicate load experienced with Azure B2C.
Files changed
hello.js — logic change in responseHandler
dist/hello.js, hello.all.js — updated distribution output to reflect the change
Compatibility & risk
Uses the standard URL API (new URL(...)) and History API (history.replaceState) which are supported in modern browsers. If you require legacy browser support (older IE), a polyfill or alternate parsing may be needed.
Behavior only changes for same-origin same-path redirects; cross-origin or different-path behavior remains unchanged (still navigates).
How to verify locally
Checkout branch:
(Use the GitHub UI or locally: git checkout fix-issue-7)
Optionally rebuild dist (recommended) to generate up-to-date minified bundles:
Install deps and build:
Reproduce the Azure B2C SPA redirect flow (or simulate a redirect that sets p.page_uri back to current page). Confirm page is loaded once and SPA state is intact after login.
Manual test: simulate p.page_uri being set to the current URL and confirm the page does not reload again (history replaces the URL).
Notes / follow-ups
I updated the non-minified dist files. I recommend running the project build (npm install then npm run build) to regenerate minified bundles (dist/*.min.js) and add them to the PR if you prefer the repo to contain built minified artifacts.
Adding an integration/browser test that asserts only one navigation in an auth flow would be nice to prevent regressions.
If you want, I can run npm install && npm run build && npm test here, commit the regenerated minified bundles, and append another small commit to the branch so the PR contains the fully rebuilt distribution.
Suggested reviewers / labels
Reviewers: repo maintainers or people familiar with OAuth response handling.
Labels: bug, fix, regression, docs (if you add changelog/notes)