-
Notifications
You must be signed in to change notification settings - Fork 194
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
acquire_token_interactive() allows customizing the redirect URI's path #593
base: dev
Are you sure you want to change the base?
Conversation
48b3c84
to
f22cd60
Compare
7f88f1c
to
87a3366
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
-
I don't think
http://localhost:port/path
is a valid redirect uri for a desktop app using system browser. The HTTP listener built in MSAL can't tell betweenhttp://localhost:port/path1
andhttp://localhost:port/path2
. I am concerned about potential vulnerability this can introduce. -
Please do not change the public API of MSAL with an OK from @localden and a discussion with other MSAL owners
-
For Public Client, please loop in @ashok672 and @iulico-1 as they need to maintain this.
Agreed with your suggestion 2 & 3. Will wait for the input from those pinged folks. With regard to suggestion 1, the
That is an implementation detail that can be discussed offline. Traditionally, MSAL uses ephemeral port, state validation and PKCE for security. Path is merely a short well-known string which does not provide any security cryptographically anyway. |
That's an excellent document you found. So I guess the user scenario is to use 1 app registration for both web and desktop? Smth like: ![]() |
That is correct. That is the scenario that app developers run into, every time they need to start their app locally for development or debug purpose. |
Minor feedback on documentation, @rayluo - other than that, looking good. |
Traditionally, most parts of the redirect URI for a desktop app is hardcoded in this library as
http://localhost
, and only the port is customizable (by aport
optional parameter).Sometimes, an app targets to multiple "platforms" (in this context, "platform" means web, native/desktop, spa, etc.), and they may all run on localhost during development. Those multiple redirect URIs differentiate with each other only by path, as described in the second last bullet point of this "localhost exceptions" documentation.
In this PR, the path will become customizable, but the remaining content (schema and host) remains constant. Therefore, the new optional parameter is
path
, rather thanredirect_uri
.This will resolve #574 .