Issue and Steps to Reproduce
With the following configuration for OIDC:
const configuration: OidcConfiguration = {
client_id: 'movies-app',
redirect_uri: `${window.location.origin}/authentication/nonsense`, // Invalid redirect URI
// silent_redirect_uri: `${window.location.origin}/authentication/silent-callback`,
scope: 'openid offline_access', // offline_access scope allows client to retrieve refresh_token
authority: 'http://localhost:8080/realms/company-services',
};
And the following router configuration:
{
path: '/',
element: <HomePage />,
},
{
path: '/admin',
element: (
<OidcSecure>
<BaseLayout />
</OidcSecure>
),
children: [
{
path: '',
element: <Home />,
},
],
},
]);
Authentication is still successful, even though the redirect_uri is set to an invalid path /authentication/nonsense, and service workers are not enabled. How is this possible.
Steps to Reproduce
- Configure the OIDC setup with the provided configuration object.
- Initiate the authentication flow by navigating to the /admin route.
- Observe that the authentication is successful, despite the invalid redirect_uri.
Versions
“@axa-fr/react-oidc”: “7.22.0-alpha.1416”,