starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[PR #2386] [MERGED] SSO/OpenID: Use a mobile-redirect route (Fixes #2379 and #2381) #3703

New Issue
Closed
opened 2026-04-25 00:16:43 +02:00 by adam · 0 comments
adam commented 2026-04-25 00:16:43 +02:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/advplyr/audiobookshelf/pull/2386
Author: @Sapd
Created: 12/4/2023
Status: ✅ Merged
Merged: 12/8/2023
Merged by: @advplyr

Base: master ← Head: sso-redirecturi

📝 Commits (6)

  • 80fd2a1 SSO/OpenID: Use a mobile-redirect route (Fixes #2379 and #2381)
  • e6ab283 SSO/OpenID: Remove modifying redirect_uri in the callback
  • cf00650 SSO/OpenID: Also fix possible race condition
  • 341a045 Update auth settings endpoint to return updated flag and show whether updates were made in client toast
  • 8f4c65e Merge branch 'master' into sso-redirecturi
  • 98104a3 Map new translations to other files

📊 Changes

22 files changed (+163 additions, -16 deletions)

View changed files

📝 client/components/ui/MultiSelect.vue (+6 -2)
📝 client/pages/config/authentication.vue (+27 -1)
📝 client/strings/cs.json (+2 -0)
📝 client/strings/da.json (+2 -0)
📝 client/strings/de.json (+2 -0)
📝 client/strings/en-us.json (+2 -0)
📝 client/strings/es.json (+2 -0)
📝 client/strings/fr.json (+2 -0)
📝 client/strings/gu.json (+2 -0)
📝 client/strings/hi.json (+2 -0)
📝 client/strings/hr.json (+2 -0)
📝 client/strings/it.json (+2 -0)
📝 client/strings/lt.json (+2 -0)
📝 client/strings/nl.json (+2 -0)
📝 client/strings/no.json (+2 -0)
📝 client/strings/pl.json (+2 -0)
📝 client/strings/ru.json (+2 -0)
📝 client/strings/sv.json (+2 -0)
📝 client/strings/zh-cn.json (+2 -0)
📝 server/Auth.js (+67 -11)

...and 2 more files

📄 Description

This PR modifies the oauth flow to always provide a https callback (which on mobile the ABS server will redirect to the app link). Also it will enable 3rd party app support as different app-callback urls are possible.

  • Implement /auth/openid/mobile-redirect this will redirect to an app-link like audiobookshelf://oauth
  • An app must provide an redirect_uri parameter with the app-link in the authorization request to /auth/openid
  • The user will have to whitelist possible URLs, or explicitly allow all
  • Also modified MultiSelect to allow to hide the menu/popup

The user needs to allow redirect-uris for mobile applications in the ABS settings, because they are now hidden from the SSO provider.
I set as default audiobookshelf://oauth, the user can also add multiple others, or just provide an asterisk allowing all URLs (or even delete the default). This way we can easily support 3rd-party apps.

In the SSO Provider, as valid redirect_uris the user now has to set:

https://absurl/auth/openid/callback
https://absurl/auth/openid/mobile-redirect

or if his auth providers supports wildcards, simply:

https://absurl/auth/openid/*

I also thought about adding a another route after the auth-request where the user is not directly forwarded to the auth provider, but to an ABS page, where ABS explains that an App wants to login. Similar to the idea suggested in #2381
However Im not sure if it would make sense, because usually the user knows in which App he is... and it does not increase security because the App name provided can simply be faked.
But if we want to do it for some reason anyways, it is possible on top of this PR.

Still a (third party) app can - and maybe should - provide a client_id in the first request with the Apps name which we could use later (possibly for logging, statistics, user sessions list etc.). I also provided it in the mobile PR.
Also the mobile app (or 3rd party app developers) now need to provide their redirect url as app-link in the auth request to /auth/openid/auth
While everything is standard oauth2, I will probably provide some guidelines in the API docs of how a 3rd party app dev can use the oauth endpoints.

Required Mobile app change: https://github.com/advplyr/audiobookshelf-app/pull/969

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/advplyr/audiobookshelf/pull/2386 **Author:** [@Sapd](https://github.com/Sapd) **Created:** 12/4/2023 **Status:** ✅ Merged **Merged:** 12/8/2023 **Merged by:** [@advplyr](https://github.com/advplyr) **Base:** `master` ← **Head:** `sso-redirecturi` --- ### 📝 Commits (6) - [`80fd2a1`](https://github.com/advplyr/audiobookshelf/commit/80fd2a1a1831b415546194fc2e7809a002f85030) SSO/OpenID: Use a mobile-redirect route (Fixes #2379 and #2381) - [`e6ab283`](https://github.com/advplyr/audiobookshelf/commit/e6ab28365fa740b72295668b924ee5b1d6640f09) SSO/OpenID: Remove modifying redirect_uri in the callback - [`cf00650`](https://github.com/advplyr/audiobookshelf/commit/cf00650c6d3bd74ddb9fae92138c00f808511150) SSO/OpenID: Also fix possible race condition - [`341a045`](https://github.com/advplyr/audiobookshelf/commit/341a0452da4044fe8bec7745d8c54b28a5c5eb6b) Update auth settings endpoint to return updated flag and show whether updates were made in client toast - [`8f4c65e`](https://github.com/advplyr/audiobookshelf/commit/8f4c65ec8c8838e71d7810266f60a85664927c27) Merge branch 'master' into sso-redirecturi - [`98104a3`](https://github.com/advplyr/audiobookshelf/commit/98104a3c03591af2c8b8885631ce5bf87c556682) Map new translations to other files ### 📊 Changes **22 files changed** (+163 additions, -16 deletions) <details> <summary>View changed files</summary> 📝 `client/components/ui/MultiSelect.vue` (+6 -2) 📝 `client/pages/config/authentication.vue` (+27 -1) 📝 `client/strings/cs.json` (+2 -0) 📝 `client/strings/da.json` (+2 -0) 📝 `client/strings/de.json` (+2 -0) 📝 `client/strings/en-us.json` (+2 -0) 📝 `client/strings/es.json` (+2 -0) 📝 `client/strings/fr.json` (+2 -0) 📝 `client/strings/gu.json` (+2 -0) 📝 `client/strings/hi.json` (+2 -0) 📝 `client/strings/hr.json` (+2 -0) 📝 `client/strings/it.json` (+2 -0) 📝 `client/strings/lt.json` (+2 -0) 📝 `client/strings/nl.json` (+2 -0) 📝 `client/strings/no.json` (+2 -0) 📝 `client/strings/pl.json` (+2 -0) 📝 `client/strings/ru.json` (+2 -0) 📝 `client/strings/sv.json` (+2 -0) 📝 `client/strings/zh-cn.json` (+2 -0) 📝 `server/Auth.js` (+67 -11) _...and 2 more files_ </details> ### 📄 Description This PR modifies the oauth flow to always provide a https callback (which on mobile the ABS server will redirect to the app link). Also it will enable 3rd party app support as different app-callback urls are possible. - Implement `/auth/openid/mobile-redirect` this will redirect to an app-link like audiobookshelf://oauth - An app must provide an `redirect_uri` parameter with the app-link in the authorization request to /auth/openid - The user will have to whitelist possible URLs, or explicitly allow all - Also modified MultiSelect to allow to hide the menu/popup The user needs to allow redirect-uris for mobile applications in the ABS settings, because they are now hidden from the SSO provider. I set as default `audiobookshelf://oauth`, the user can also add multiple others, or just provide an asterisk allowing all URLs (or even delete the default). This way we can easily support 3rd-party apps. In the SSO Provider, as valid redirect_uris the user now has to set: ``` https://absurl/auth/openid/callback https://absurl/auth/openid/mobile-redirect ``` or if his auth providers supports wildcards, simply: ``` https://absurl/auth/openid/* ``` I also thought about adding a another route after the auth-request where the user is not directly forwarded to the auth provider, but to an ABS page, where ABS explains that an App wants to login. Similar to the idea suggested in #2381 However Im not sure if it would make sense, because usually the user knows in which App he is... and it does not increase security because the App name provided can simply be faked. But if we want to do it for some reason anyways, it is possible on top of this PR. Still a (third party) app can - and maybe should - provide a `client_id` in the first request with the Apps name which we could use later (possibly for logging, statistics, user sessions list etc.). I also provided it in the mobile PR. Also the mobile app (or 3rd party app developers) now need to provide their redirect url as app-link in the auth request to `/auth/openid/auth` While everything is standard oauth2, I will probably provide some guidelines in the API docs of how a 3rd party app dev can use the oauth endpoints. Required Mobile app change: https://github.com/advplyr/audiobookshelf-app/pull/969 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
adam added the pull-request label 2026-04-25 00:16:43 +02:00
adam closed this issue 2026-04-25 00:16:44 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#3703
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?