Skip to content

fix(oauth2-redirect): guard window.opener for cross-origin flows#10867

Open
yogeshwaran-c wants to merge 1 commit into
swagger-api:masterfrom
yogeshwaran-c:fix/oauth2-redirect-window-opener-null
Open

fix(oauth2-redirect): guard window.opener for cross-origin flows#10867
yogeshwaran-c wants to merge 1 commit into
swagger-api:masterfrom
yogeshwaran-c:fix/oauth2-redirect-window-opener-null

Conversation

@yogeshwaran-c
Copy link
Copy Markdown

Description

When the OAuth2 authorization flow goes through a cross-origin redirect, browser policy can sever window.opener on the redirect tab. The current dev-helpers/oauth2-redirect.js (which webpack copies to dist/oauth2-redirect.html) accesses window.opener.swaggerUIRedirectOauth2 unconditionally, throwing TypeError: Cannot read properties of null (reading 'swaggerUIRedirectOauth2') and leaving the user staring at a blank redirect tab.

This PR adds a single guard at the top of run() that detects the missing opener and surfaces a clear instruction to the user instead of crashing silently.

Motivation and Context

Refs: #10786, #6150

Both issues report the redirect tab failing without a useful message in cross-origin OAuth flows. The fix is the minimum needed to convert the silent crash into actionable feedback; it does not alter the success path.

How Has This Been Tested?

  • New Jest unit test test/unit/core/oauth2-redirect.js exercises the script under three scenarios:
    • window.opener is null → no throw, instruction text is shown
    • window.opener exists but swaggerUIRedirectOauth2 is missing → no throw, instruction text is shown
    • opener and oauth2 state are present → existing success path is preserved
  • 3/3 unit tests pass locally:
    PASS test/unit/core/oauth2-redirect.js (47 s)
    Tests:       3 passed, 3 total
    

Checklist

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have added tests to cover my changes.
  • All new and existing tests passed.

Cross-origin navigation can sever window.opener (browser policy), causing
the redirect page to crash with TypeError when accessing
window.opener.swaggerUIRedirectOauth2. Guard the access and surface a clear
message to the user instead of failing silently.

Refs: swagger-api#10786, swagger-api#6150
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant