Skip to content

fix: handle url fragments for redirects#4464

Open
hvoort wants to merge 2 commits intodexidp:masterfrom
hvoort:fix-fragment-handling
Open

fix: handle url fragments for redirects#4464
hvoort wants to merge 2 commits intodexidp:masterfrom
hvoort:fix-fragment-handling

Conversation

@hvoort
Copy link
Copy Markdown

@hvoort hvoort commented Jan 7, 2026

Overview

Includes original URL fragment throughout auth process to keep it in the original redirect.

What this PR does / why we need it

Closes #4462

Including the URL fragment on the pages that do form posts to different URL (not to self) and anchor links to providers.

Special notes for your reviewer

What are implications of adding the hash to the URLs on the login.html page. Do some providers use the hash and if so this will mess up the url fragment. Maybe we should only add it to the password.html page.

Tested manually using the following flow:

  1. Run dex ./bin/dex serve examples/config-dev.yaml
  2. Run example app cd examples && go run ./example-app
  3. Go to http://127.0.0.1:5555/ click login
  4. Add #foobar to the URL and force refresh
  5. Click "Login with email" and observe the fragment is still there
  6. Add #foobar to the URL and force refresh
  7. Login using static user credentials admin@example.com and password and observe the fragment is still there after being redirected.

@nabokihms nabokihms added the release-note/bug-fix Release note: Bug Fixes label Jan 12, 2026
Comment thread web/templates/login.html Outdated

<script type="text/javascript">
if (window.location.hash) {
var buttons = document.querySelectorAll('div.theme-form-row a');
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
var buttons = document.querySelectorAll('div.theme-form-row a');
var buttons = document.querySelectorAll('div.theme-form-row a');

NIT: Can we make the selector more straightforward? Maybe we can add ID to the password button.

Copy link
Copy Markdown
Author

@hvoort hvoort Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you mean to only change the button that is linking to a password connector, or all connectors? I think this applies to all connectors. Because a press on any provider button will not include the url fragment, if not explicitly injected.

If you want to support all connectors, I can make it more specific by adding a class to the anchor elements "provider-anchor" and update the query selector to a.provider-anchor.
(edit: or maybe better to add an id attribute "providers" to the parent div and then use "#providers a")

Or do you have something else in mind?

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are selecting div by a class, and I think more about selecting div by id or something.

getElementById('myId') or querySelectorAll('div#myId')

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Allright. I added id providers to the container div and now select all anchors found in the providers element using #providers a.

I cannot set unique id attribute on anchors because we loop through connectors. Unless we use the connector's identifier (if it exists) as id, with the downside we have to loop over these identifiers in javascript as well. To get these identifiers into javascript we will have to mix the template language and javascript, and this is asking for trouble if you ask me.

Let me know what you think

@hvoort hvoort force-pushed the fix-fragment-handling branch 3 times, most recently from 1b59612 to f3ee31f Compare April 1, 2026 09:25
Huub and others added 2 commits April 1, 2026 11:27
Signed-off-by: Huub van der Voort <github@hvdvoort.nl>
Signed-off-by: Huub van der Voort <github@hvdvoort.nl>
@hvoort hvoort force-pushed the fix-fragment-handling branch from f3ee31f to c35df8d Compare April 1, 2026 09:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release-note/bug-fix Release note: Bug Fixes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

URL fragment is lost when using username/password form

2 participants