Extract and decode the returnToUrl from session when resuming user workflow.

Author: dmitrizagidulin

src/handlers/auth-callback-request.js

@@ -55,17 +55,17 @@ class AuthCallbackRequest {
     }
 
     let requestUri = AuthCallbackRequest.fullUriFor(req)
-
     let issuer = AuthCallbackRequest.extractIssuer(req)
+    let returnToUrl = AuthCallbackRequest.extractReturnToUrl(req.session)
 
     let options = {
       issuer,
       requestUri,
       oidcManager,
       serverUri,
+      returnToUrl,
       response: res,
-      session: req.session,
-      returnToUrl: req.session.returnToUrl
+      session: req.session
     }
 
     let request = new AuthCallbackRequest(options)
@@ -96,6 +96,20 @@ class AuthCallbackRequest {
     return req.params && decodeURIComponent(req.params.issuer_id)
   }
 
+  /**
+   * Extracts the `returnToUrl` that was stored in session during the
+   * SelectProviderRequest handling.
+   *
+   * @param session
+   *
+   * @returns {string|null}
+   */
+  static extractReturnToUrl (session) {
+    const returnToUrl = session.returnToUrl
+
+    return returnToUrl ? decodeURIComponent(returnToUrl) : null
+  }
+
   validate () {
     if (!this.issuer) {
       let error = new Error('Issuer id is missing from request params')
@@ -158,6 +172,7 @@ class AuthCallbackRequest {
     this.debug('  Resuming workflow, redirecting to ' + this.returnToUrl)
 
     delete this.session.returnToUrl
+
     return this.response.redirect(302, this.returnToUrl)
   }
 }

test/unit/auth-callback-request.js

@@ -77,7 +77,8 @@ describe('AuthCallbackRequest', () => {
 
       let oidcManager = {}
       let host = { serverUri: 'https://example.com' }
-      let session = { returnToUrl: 'https://example.com/resource' }
+      let returnToUrl = 'https://example.com/resource#hash'
+      let session = { returnToUrl: encodeURIComponent(returnToUrl) }
 
       let req = {
         session,
@@ -96,7 +97,24 @@ describe('AuthCallbackRequest', () => {
       expect(request.oidcManager).to.equal(oidcManager)
       expect(request.response).to.equal(res)
       expect(request.session).to.equal(session)
-      expect(request.returnToUrl).to.equal(session.returnToUrl)
+      expect(request.returnToUrl).to.equal(returnToUrl)
+    })
+  })
+
+  describe('static extractReturnToUrl()', () => {
+    it('should return null if no returnToUrl is present in session', () => {
+      let session = {}
+
+      expect(AuthCallbackRequest.extractReturnToUrl(session))
+        .to.be.null()
+    })
+
+    it('should return a url-decoded returnToUrl from session', () => {
+      let returnToUrl = 'https://example.com/resource#hash'
+      let session = { returnToUrl: encodeURIComponent(returnToUrl) }
+
+      expect(AuthCallbackRequest.extractReturnToUrl(session))
+        .to.equal(returnToUrl)
     })
   })