Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Some OAuth2 server doesn't correctly parse url and broke query parameters of the result redirect url.
For example:
Currently generated url:
https://local.host/redirect_page?plugin=my_plugin
Expected generated url:
https://local.host/redirect_page
Currently received request from OAuth2 server:
https://local.host/redirect_page?plugin=my_plugin?code=....
Expected received request from OAuth2 server:
https://local.host/redirect_page?code=....
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | 3024416-02.patch | 4.19 KB | voleger |
Comments
Comment #2
volegerHere the patch that removes adding query string. Also, adapted testing form to the new routes.
Comment #3
dashohoxha commentedI have not been able to participate in the recent discussion and development because I cannot test the 8.x branches. But I think that you are doing fine.
However this issue is conceptual. I don't see anything wrong with query parameters as long as the server has no problem with them. The example that you have presented seems Ok to me. I am not sure, but I think that the OAuth2 standard allows this thing (sending query parameters to the server). If the standard allows it, then it is Ok.
Comment #5
jaypanThe problem wasn't in allowing fragments, it was in forcing a specific fragment. I was coming at it from the wrong direction, Volergar's patch is a definite improvement. It's been applied, and a 8.x-2.0-beta3 has been released.
Comment #6
jaypan