Fix base URI not included in generated OpenID Connect URLs (#1524)

semaphoreui · Feb 5, 2024 · 73e661f · 73e661f
1 parent 3898172
commit 73e661f
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 11 deletions.
diff --git a/api/login.go b/api/login.go
@@ -367,7 +367,8 @@ func oidcLogin(w http.ResponseWriter, r *http.Request) {
  _, oauth, err := getOidcProvider(pid, ctx)
  if err != nil {
  log.Error(err.Error())
- http.Redirect(w, r, "/auth/login", http.StatusTemporaryRedirect)
+ loginURL, _ := url.JoinPath(util.Config.WebHost, "auth/login")
+ http.Redirect(w, r, loginURL, http.StatusTemporaryRedirect)
  return
  }
  state := generateStateOauthCookie(w)
@@ -479,29 +480,31 @@ func getSecretFromFile(source string) (string, error) {
 func oidcRedirect(w http.ResponseWriter, r *http.Request) {
  pid := mux.Vars(r)["provider"]
  oauthState, err := r.Cookie("oauthstate")
+ loginURL, _ := url.JoinPath(util.Config.WebHost, "auth/login")
+
  if err != nil {
  log.Error(err.Error())
- http.Redirect(w, r, "/auth/login", http.StatusTemporaryRedirect)
+ http.Redirect(w, r, loginURL, http.StatusTemporaryRedirect)
  return
  }
 
  if r.FormValue("state") != oauthState.Value {
- http.Redirect(w, r, "/auth/login", http.StatusTemporaryRedirect)
+ http.Redirect(w, r, loginURL, http.StatusTemporaryRedirect)
  return
  }
 
  ctx := context.Background()
  _oidc, oauth, err := getOidcProvider(pid, ctx)
  if err != nil {
  log.Error(err.Error())
- http.Redirect(w, r, "/auth/login", http.StatusTemporaryRedirect)
+ http.Redirect(w, r, loginURL, http.StatusTemporaryRedirect)
  return
  }
 
  provider, ok := util.Config.OidcProviders[pid]
  if !ok {
  log.Error(fmt.Errorf("no such provider: %s", pid))
- http.Redirect(w, r, "/auth/login", http.StatusTemporaryRedirect)
+ http.Redirect(w, r, loginURL, http.StatusTemporaryRedirect)
  return
  }
 
@@ -512,7 +515,7 @@ func oidcRedirect(w http.ResponseWriter, r *http.Request) {
  oauth2Token, err := oauth.Exchange(ctx, code)
  if err != nil {
  log.Error(err.Error())
- http.Redirect(w, r, "/auth/login", http.StatusTemporaryRedirect)
+ http.Redirect(w, r, loginURL, http.StatusTemporaryRedirect)
  return
  }
 
@@ -551,7 +554,7 @@ func oidcRedirect(w http.ResponseWriter, r *http.Request) {
 
  if err != nil {
  log.Error(err.Error())
- http.Redirect(w, r, "/auth/login", http.StatusTemporaryRedirect)
+ http.Redirect(w, r, loginURL, http.StatusTemporaryRedirect)
  return
  }
 
@@ -566,18 +569,18 @@ func oidcRedirect(w http.ResponseWriter, r *http.Request) {
  user, err = helpers.Store(r).CreateUserWithoutPassword(user)
  if err != nil {
  log.Error(err.Error())
- http.Redirect(w, r, "/auth/login", http.StatusTemporaryRedirect)
+ http.Redirect(w, r, loginURL, http.StatusTemporaryRedirect)
  return
  }
  }
 
  if !user.External {
  log.Error(fmt.Errorf("OIDC user '%s' conflicts with local user", user.Username))
- http.Redirect(w, r, "/auth/login", http.StatusTemporaryRedirect)
+ http.Redirect(w, r, loginURL, http.StatusTemporaryRedirect)
  return
  }
 
  createSession(w, r, user)
 
- http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
+ http.Redirect(w, r, util.Config.WebHost, http.StatusTemporaryRedirect)
 }
diff --git a/web/src/views/Auth.vue b/web/src/views/Auth.vue
@@ -232,7 +232,7 @@ export default {
  },
 
  async oidcSignIn(provider) {
- document.location = `/api/auth/oidc/${provider}/login`;
+ document.location = `${document.baseURI}api/auth/oidc/${provider}/login`;
  },
  },
 };