Infinite redirect loop with prompt=select_account

[stefanfoulis]

related to #187

The only difference between prompt=login and prompt=select_account seems to be that with prompt=login the prompt GET parameter is removed from next_page before redirecting to the login page.
It looks like because it is not removed with prompt=select_account we end up with an infinite loop.

Probably we should just make prompt=select_acconunt behave the same as prompt=login.

To properly support prompt=select_account in the future, we'd probably need to provide some sort of hook so that developers can add logic to handle this special case correctly on the login page 🤔 . Perhaps pass the prompt=select_account GET parameter to the login page itself, instead of in next_page.

[khasbilegt]

Hello @stefanfoulis, my understanding of the prompt=login should force the user to reauthenticate even when there's a valid session. However most of the django implementations just simply redirect the user to the login page when there's a prompt parameter exists. Shouldn't there be some force session invalidation or some logic before the redirect?

[stefanfoulis]

Hello @stefanfoulis, my understanding of the prompt=login should force the user to reauthenticate even when there's a valid session. However most of the django implementations just simply redirect the user to the login page when there's a prompt parameter exists. Shouldn't there be some force session invalidation or some logic before the redirect?

That's a good point. So probably we should remove the prompt= value from the next_page in both cases and instead set them on the login url, so that it can be dealt with there. I don't think the login page should have to introspect next_page to retrieve that information.

[khasbilegt]

If you look into the prompt=login implementation of DOT, they work the similar way but without any forced session invalidation. Due to an inability to expire session from the client (in my case the browser length session cookies weren't removed), I had to resort to this params, so the user can switch their accounts. In order to do that I modified the view, that's in charge of handling the authorize request, to call the logout function and then redirect to the login url with next_page.