Skip to content

Commit

Permalink
fix: respect return_to URL parameter in registration flow when the …
Browse files Browse the repository at this point in the history
…user is already registered (#2957)
  • Loading branch information
supercairos authored Dec 19, 2022
1 parent 03b3c29 commit 3462ce1
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 1 deletion.
11 changes: 10 additions & 1 deletion selfservice/flow/registration/handler.go
Original file line number Diff line number Diff line change
Expand Up @@ -290,7 +290,16 @@ func (h *Handler) createBrowserRegistrationFlow(w http.ResponseWriter, r *http.R
return
}

http.Redirect(w, r, h.d.Config().SelfServiceBrowserDefaultReturnTo(r.Context()).String(), http.StatusSeeOther)
returnTo, redirErr := x.SecureRedirectTo(r, h.d.Config().SelfServiceBrowserDefaultReturnTo(r.Context()),
x.SecureRedirectAllowSelfServiceURLs(h.d.Config().SelfPublicURL(r.Context())),
x.SecureRedirectAllowURLs(h.d.Config().SelfServiceBrowserAllowedReturnToDomains(r.Context())),
)
if redirErr != nil {
h.d.SelfServiceErrorManager().Forward(r.Context(), w, r, redirErr)
return
}

http.Redirect(w, r, returnTo.String(), http.StatusSeeOther)
return
}

Expand Down
10 changes: 10 additions & 0 deletions selfservice/flow/registration/handler_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,10 @@ func TestHandlerRedirectOnAuthenticated(t *testing.T) {
router := x.NewRouterPublic()
ts, _ := testhelpers.NewKratosServerWithRouters(t, reg, router, x.NewRouterAdmin())

// Set it first as otherwise it will overwrite the ViperKeySelfServiceBrowserDefaultReturnTo key;
returnToTS := testhelpers.NewRedirTS(t, "return_to", conf)
conf.MustSet(ctx, config.ViperKeyURLsAllowedReturnToDomains, []string{returnToTS.URL})

redirTS := testhelpers.NewRedirTS(t, "already authenticated", conf)
conf.MustSet(ctx, config.ViperKeySelfServiceRegistrationEnabled, true)
testhelpers.SetDefaultIdentitySchema(conf, "file://./stub/identity.schema.json")
Expand All @@ -58,6 +62,12 @@ func TestHandlerRedirectOnAuthenticated(t *testing.T) {
assert.Contains(t, res.Request.URL.String(), registration.RouteInitAPIFlow)
assertx.EqualAsJSON(t, registration.ErrAlreadyLoggedIn, json.RawMessage(gjson.GetBytes(body, "error").Raw))
})

t.Run("does redirect to return_to url on authenticated request", func(t *testing.T) {
body, res := testhelpers.MockMakeAuthenticatedRequest(t, reg, conf, router.Router, x.NewTestHTTPRequest(t, "GET", ts.URL+registration.RouteInitBrowserFlow+"?return_to="+returnToTS.URL, nil))
assert.Contains(t, res.Request.URL.String(), returnToTS.URL)
assert.EqualValues(t, "return_to", string(body))
})
}

func TestInitFlow(t *testing.T) {
Expand Down

0 comments on commit 3462ce1

Please sign in to comment.