response_mode with form_post and Request

[unuseless]

Currently I'm using the authorizationCodeGrant and getting a response from the server as a response_mode form_post with express 4.x.x.

The documentation for authorizationCodeGrant says to provide a currentUrl as either a URL or a Request.

As a form_post has no URLSearchParams, but a body with the parameters, I can either construct a currentUrl with search parameters from the body:

function getCurrentURL(req) {
  // This is a workaround until express5, when req.host will return the the port number if present.
  // https://github.com/panva/openid-client/issues/733
  // https://github.com/panva/openid-client/issues/746
  const proxyHost = req.headers["x-forwarded-host"];
  const host = proxyHost ? proxyHost : req.headers.host;
  return new URL(`${req.protocol}://${host}${req.originalUrl ?? req.url}`);
}
const currentURL = getCurrentURL(req);

// Get the URLSearchParams object from the URL and modify it
    Object.entries(cbreq.body).forEach(([key, value]) => {
      currentURL.searchParams.append(key, value);
    });

and then use this currentURL with the constructed URLSearchParams.

As an alternative I can construct a Request:

 const request = new Request(currentURL.href, {
      method: "POST",
      body: JSON.stringify({ ...cbreq.body}),
    });

and use this request in the call.

tokenSet = await client.authorizationCodeGrant(
        config,
        request,
        // or currentURL,
       ...
      );

Both methods "work", however I'm don't know if there is a better method or if one method is preferred. Advice is very much appreciated.

[panva]

I think this is preferred, but you need to disable the upstream request body parser to be able to let the module do it's thing. Your JSON body shouldn't work.

        input = new Request(currentUrl.href, {
          method: 'POST',
          headers: Object.entries(req.headersDistinct).reduce(
            (acc, [key, values]) => {
              for (const value of values!) {
                acc.append(key, value)
              }
              return acc
            },
            new Headers(),
          ),
          body: req,
          duplex: 'half',
        })

[unuseless]

Thanks for the fast help!

Not sure if it is ok to report here: it seems a Request as input works only with method: 'POST'.

We currently rewrite the request body parameters as URLSearchParams, as this seems the most feasible method with our codebase. Disabling the request body parser is not possible for us at this moment.

[panva]

Not sure if it is ok to report here: it seems a Request as input works only with method: 'POST'.

That's not what i'm observing. Docs should be improved for sure.

A Request can be passed and the authorization response parameters as well as the current url to be used in the access token request are resolved from the request's url getter, specifically it's searchParams when using code flow, its fragment when using the useCodeIdTokenResponseType configuration.

Additionally, when the client uses the useCodeIdTokenResponseType configuration (to make use of response_type=code+id_token) then, and only then, does response_mode=form_post make sense and a POST Response will have its body parsed by the module.

[benkroeger]

on this topic - since I am also parsing my request separately before invoking authorizationCodeGrant...
are there plans allow running the codeGrant process with 'preprocessed' input data?

I don't want to pass the entire request since it may contain sensitive information (client ip, proxies, client cert, ...)

Happy to continue discussing options here

[benkroeger]

sounds potentially error-prone. will see how to incorporate that in our server. (we're using code+id_token as response_type)

[panva]

sounds potentially error-prone. will see how to incorporate that in our server. (we're using code+id_token as response_type)

You can either disable your body parser and pass a Response instance, or just the URL instance as if it was a response_mode=fragment (which it would be by default if response_mode=form_post wasn't explicitly used)

const url = new URL(currentUrl.href)
url.hash = new URLSearchParams(parsedBody).toString()

[benkroeger]

I switched to mandatory authorization code flow and filter searchParams in currentUrl to only include whitelisted params.
Thanks for your help

[panva]

I don't understand the mandatory part or why you're filtering searchParams at all...

[benkroeger]

I suppose those are irrelevant implementation details from my use-case.
more importantly though is that it works now.
thanks