You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
export async function getAuthorizationUrl(query, options) {
const { logger, provider } = options;
let url = provider.authorization?.url;
let as;
// Falls back to authjs.dev if the user only passed params
if (!url || url.host === 'authjs.dev' || true) {
// If url is undefined, we assume that issuer is always defined
// We check this in assert.ts
// eslint-disable-next-line @typescript-eslint/no-non-null-assertion
const issuer = new URL(provider.issuer);
const discoveryResponse = await o.discoveryRequest(**issuer**);
const as = await o.processDiscoveryResponse(issuer, discoveryResponse);
if (!as.authorization_endpoint) {
throw new TypeError(
'Authorization server did not provide an authorization endpoint.'
);
}
url = new URL(as.authorization_endpoint);
}
export async function discoveryRequest(issuerIdentifier, options) {
if (!(issuerIdentifier instanceof URL)) {
throw new TypeError('"issuerIdentifier" must be an instance of URL');
}
if (issuerIdentifier.protocol !== 'https:' && issuerIdentifier.protocol !== 'http:') {
throw new TypeError('"issuer.protocol" must be "https:" or "http:"');
}
const url = new URL(issuerIdentifier.href);
switch (options?.algorithm) {
case undefined:
case 'oidc':
url.pathname = `${url.pathname}/.well-known/openid-configuration`.replace('//', '/');
break;
case 'oauth2':
if (url.pathname === '/') {
url.pathname = '.well-known/oauth-authorization-server';
}
else {
url.pathname = `.well-known/oauth-authorization-server/${url.pathname}`.replace('//', '/');
}
break;
default:
throw new TypeError('"options.algorithm" must be "oidc" (default), or "oauth2"');
}
const headers = prepareHeaders(options?.headers);
headers.set('accept', 'application/json');
return (options?.[customFetch] || fetch)(url.href, {
headers: Object.fromEntries(headers.entries()),
method: 'GET',
redirect: 'manual',
signal: options?.signal ? signal(options.signal) : null,
}).then(processDpopNonce);
}
As you can see above, we are passing issuer in discoveryRequest function which always results in response from the default tenant of our provider instead of the tenant whose id we have passed while configuring our provider. This can fetch incorrect authorization url from default tenant.
You will get information from default tenant instead of the tenantId you have passed
Expected behavior
We should be passing provider.wellKnown in discoveryRequest function everywhere as it already takes its correct tenant well known url into account.
The text was updated successfully, but these errors were encountered:
VishalRathoreSM
added
bug
Something isn't working
triage
Unseen or unconfirmed by a maintainer yet. Provide extra information in the meantime.
labels
Nov 19, 2024
Environment
Reproduction URL
https://github.com/FusionAuth/fusionauth-quickstart-javascript-nextjs-web
Describe the issue
As you can see above, we are passing issuer in discoveryRequest function which always results in response from the default tenant of our provider instead of the tenant whose id we have passed while configuring our provider. This can fetch incorrect authorization url from default tenant.
How to reproduce
Expected behavior
We should be passing provider.wellKnown in
discoveryRequest
function everywhere as it already takes its correct tenant well known url into account.The text was updated successfully, but these errors were encountered: