Zibbp opened a new pull request, #45477: URL: https://github.com/apache/superset/pull/45477
<!--- Please write the PR title following the conventions at https://www.conventionalcommits.org/en/v1.0.0/ Example: fix(dashboard): load charts correctly --> ### SUMMARY When using OAuth/OIDC, `SupersetClient` sends the browser to `${appRoot}/login?next=<current url>` with the value interpolated raw. The current URL carries its own query string, so the first `&` terminates `next` during query parsing and every parameter after it is dropped. This is an issue if you visit a url such as `/explore/?form_data_key=&datasource_id=292&datasource_type=table` where query params are already populated. Instead of it working, the login process directs you to `/explore/?form_data_key=`, dropping all query params, after the IdP flow. The `src/pages/Login/index.tsx` page already encodes `next` correctly, so use `encodeURIComponent` here to fix. https://github.com/apache/superset/blob/master/superset-frontend/src/pages/Login/index.tsx#L85-L98 ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF No visual change. A captured flow from Chrome devtools: | step | before | after | |---|---|---| | `/login` redirect | `?next=https://host/explore/?form_data_key=&datasource_id=292&datasource_type=table` | `?next=https%3A%2F%2Fhost%2Fexplore%2F%3Fform_data_key%3D%26datasource_id%3D292%26datasource_type%3Dtable` | | `/login/azure?next=` | `https%3A%2F%2Fhost%2Fexplore%2F%3Fform_data_key%3D` | `...%3Fform_data_key%3D%26datasource_id%3D292%26datasource_type%3Dtable` | | OAuth `state` payload | `{"next":["…/explore/?form_data_key="]}` | `{"next":["…/explore/?form_data_key=&datasource_id=292&datasource_type=table"]}` | | after signing in | `/explore/?form_data_key=` | `/explore/?form_data_key=&datasource_id=292&datasource_type=table` | ### TESTING INSTRUCTIONS Manual check (any auth type; OAuth shows it most clearly): 1. In a logged-out browser, visit a URL whose query string contains &, e.g. `/explore/?form_data_key=&datasource_id=292&datasource_type=table`. 2. Confirm the address bar becomes `/login/?next=<fully percent-encoded URL>` in particular that `%26datasource_id%3D292%26datasource_type%3Dtable` is still there. 3. Sign in with the provider and confirm you land back on the original URL with all parameters intact. 4. In DevTools Network, `/login/azure?next=` and the IdP state parameter should both carry the full URL. ### ADDITIONAL INFORMATION <!--- Check any relevant boxes with "x" --> <!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue --> - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
