SPA and '#' in URL about oidc-client-js

[brockallen]

So to your question I can answer: "URL processing would then have to scan for ?" (without special provisions to hashtag).

I'd have to think about it if I wanted to add it into the core. For now, you can do the parsing yourself and just pass it into the callback API.

Could you please point me to where "spec prohibits the callback URL to contain a #"?

https://tools.ietf.org/html/rfc6749#section-3.1.2

[brockallen]

When you're using hashtags in the URL, this library will have no idea where your route ends and the OIDC response params begin. That's what on the callback APIs you can pass the params, as it looks like you're doing above. You just need to strip off the part before the params.

[Ph47]

Generally - no. Route - is all things from '#' to '?'. I don't know about angular style but Durandal use '?' for query string. Even if you're right about two parts, OIDC parameters always last and named constantly (id_token, access_token). I see no reason to break URL scan after hashtag.

[brockallen]

So the URL processing would then have to scan for ? after # in case it's a routing style URL. That sounds slightly presumptive, and that's why you always have the option to pass the URL you want processed in as a param to the callback APIs.

Technically the spec prohibits the callback URL to contain a #, but we leave this decision up to you.

[Ph47]

So to your question I can answer: "URL processing would then have to scan for ?" (without special provisions to hashtag).

Could you please point me to where "spec prohibits the callback URL to contain a #"? I found only paragraph about Identifier Normalization. According to specification https://openid.net/specs/openid-authentication-2_0.htm only Identifiers MUST be normalized (include stripping fragment part). The openid.return_to is URL (not Identifier) and does not require normalization.

I pay so much attention to this issue because yours Identity Server is best tool for me in question of building SPA authorization. SPA must use # for route in compatibility purposes (https://en.wikipedia.org/wiki/Single-page_application).

SPA developers needed in such solution (oidc-client), as I wrote to you a year ago, and you did it. I am grateful to you for it.

[brockallen]

Since you have a workaround, I'll close this.