Details
Description
This patch fixes an issue with liboauth where the "next" url parameter did not get through the OAuth flow, getting clobbered in the sign-on stage.
To reproduce
- Set up Google (or other OAuth 2 provider) authentication with Hue (I followed this guide http://gethue.com/single-sign-on-in-hue-with-twitter-and-oauth/)
- Attempt to visit a non-home URL while not signed in (for example, http://hue.example.com/desktop/dump_config)
- Follow a successful sign-in flow
- Instead of being directed to /desktop/dump_config (the original URL), you will be directed to /about.
How this patch fixes the issue
On many providers, there is the ability to use a "state" parameter to send around some data that should be received on successful OAuth authentication. Currently, Hue uses this parameter to detect which social method of login is used (i.e. Facebook, Twitter, Google, etc). This patch extends that to a comma separated list of the social used (as above) and the path to return to after successful login.
Impact of this issue
Internally we have tooling that points towards a specific deep link within our Hue. Our users click on these URLs, go through sign in flow, and end up at the /about route. This means they have to go click the link again, and is confusing for our less technical users especially.