From b8db1f87f8bb00c59e710e847b0294d067f57fdb Mon Sep 17 00:00:00 2001 From: cclohmar Date: Mon, 15 Jun 2026 20:18:26 +0000 Subject: [PATCH] fix(auth): state carries target URL, cross-subdomain cookie domain --- src/core/auth/oidc.go | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/core/auth/oidc.go b/src/core/auth/oidc.go index f14833c..cc2cd6a 100644 --- a/src/core/auth/oidc.go +++ b/src/core/auth/oidc.go @@ -35,7 +35,14 @@ func NewOIDCHandler(config OIDCConfig, store *SessionStore) *OIDCHandler { // LoginRedirect redirects the user to Authelia's OIDC authorization endpoint. func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) { - state := generateToken(16) + // Get target URL from current request path + targetURL := r.URL.Path + if targetURL == "/" || targetURL == "/access" { + targetURL = "/" + } + // Embed target in state: random_token:target_url + randPart := generateToken(16) + state := randPart + ":" + targetURL nonce := generateToken(16) // PKCE: generate code verifier and challenge @@ -45,7 +52,7 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) { // Store state + verifier in cookies (shared across subdomains) http.SetCookie(w, &http.Cookie{ Name: "oidc_state", - Value: state, + Value: randPart, Path: "/", MaxAge: 300, HttpOnly: true, @@ -65,7 +72,7 @@ func (h *OIDCHandler) LoginRedirect(w http.ResponseWriter, r *http.Request) { h.config.IssuerURL, url.QueryEscape(h.config.ClientID), url.QueryEscape(h.config.RedirectURL), - state, + url.QueryEscape(state), nonce, challenge, ) @@ -243,7 +250,6 @@ func (h *OIDCHandler) LoginRedirectWithPrompt(w http.ResponseWriter, r *http.Req verifier := generateToken(32) challenge := pkceChallenge(verifier) - authURL := fmt.Sprintf( "%s/api/oidc/authorize?prompt=%s&response_type=code&client_id=%s&redirect_uri=%s&scope=openid+profile+email&state=%s&nonce=%s&code_challenge=%s&code_challenge_method=S256", h.config.IssuerURL, prompt,