Skip to content

Conversation

@qiwzhang
Copy link
Contributor

@qiwzhang qiwzhang commented Aug 1, 2017

If authentication fail with invalid token or expired token, and if authorization url is set, response with 302 with that url.

@lizan
Copy link
Contributor

lizan commented Aug 1, 2017

If authentication fail with invalid token or expired token, and if authorization url is set, response with 302 with that url.

Any documentation describing this behavior? I couldn't find this in OpenAPI spec.

@qiwzhang
Copy link
Contributor Author

qiwzhang commented Aug 1, 2017

Flex team requires us to behave such way to support their Auth.

@lizan
Copy link
Contributor

lizan commented Aug 1, 2017

From: OpenAPI spec and OpenID Connect spec I feel the redirection should also include more request parameters extract from JWT, no?

The code itself LGTM.

@qiwzhang qiwzhang merged commit 8b7c165 into cloudendpoints:master Aug 1, 2017
@qiwzhang qiwzhang deleted the authorization_url branch August 1, 2017 23:02
@maroux
Copy link
Contributor

maroux commented Sep 10, 2019

Just ran into this "feature" which really sounds like a bug to me. Why should presence of authorizationUrl dictate 401 vs 302? Workaround is to set authorizationUrl: "" since it is required but can be empty.. At the very least, this should be documented here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants