go-pkgz / auth / 32195644597

86%

push

github

fix: use 303 for the post-auth redirect to "from" (#302)

Previously the callback handlers redirected to the handshake "from" target
with 307, which requires the browser to repeat the original request method.
Apple is the only provider whose callback arrives as POST: response_mode
defaults to form_post and prepareLoginURL refuses anything else once a scope
is requested. The browser therefore replayed the POST onto the "from" page,
and a static file server answering GET only responded 405, leaving the login
popup on an error page even though the session cookie had already been set.

After this change the browser retrieves the target with GET. For oauth1,
oauth2 and verify the callback is already a GET, so their observable
behaviour is unchanged.

3 of 4 new or added lines in 4 files covered. (75.0%)

3186 of 3701 relevant lines covered (86.08%)

9.04 hits per line