Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support authorization url #228

Merged
merged 4 commits into from
Aug 1, 2017
Merged

Support authorization url #228

merged 4 commits into from
Aug 1, 2017

Conversation

qiwzhang
Copy link
Contributor

@qiwzhang qiwzhang commented Aug 1, 2017

If authentication fail with invalid token or expired token, and if authorization url is set, response with 302 with that url.

@lizan
Copy link
Contributor

lizan commented Aug 1, 2017

If authentication fail with invalid token or expired token, and if authorization url is set, response with 302 with that url.

Any documentation describing this behavior? I couldn't find this in OpenAPI spec.

@qiwzhang
Copy link
Contributor Author

qiwzhang commented Aug 1, 2017

Flex team requires us to behave such way to support their Auth.

@lizan
Copy link
Contributor

lizan commented Aug 1, 2017

From: OpenAPI spec and OpenID Connect spec I feel the redirection should also include more request parameters extract from JWT, no?

The code itself LGTM.

@qiwzhang qiwzhang merged commit 8b7c165 into cloudendpoints:master Aug 1, 2017
@qiwzhang qiwzhang deleted the authorization_url branch August 1, 2017 23:02
@maroux
Copy link
Contributor

maroux commented Sep 10, 2019

Just ran into this "feature" which really sounds like a bug to me. Why should presence of authorizationUrl dictate 401 vs 302? Workaround is to set authorizationUrl: "" since it is required but can be empty.. At the very least, this should be documented here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants