Merge pull request #256 from ajgarlag/fix-fragment-urls

Fix redirection URLs when implicit grant is denied

Author: chalasr

src/Controller/AuthorizationController.php

@@ -111,7 +111,7 @@ public function indexAction(Request $request): Response
 
             $response = $this->server->completeAuthorizationRequest($authRequest, $serverResponse);
         } catch (OAuthServerException $e) {
-            $response = $e->generateHttpResponse($serverResponse);
+            $response = $e->generateHttpResponse($serverResponse, str_contains($e->getRedirectUri() ?? '', '#'));
         }
 
         return $this->httpFoundationFactory->createResponse($response);

tests/Acceptance/AuthorizationEndpointTest.php

@@ -545,4 +545,33 @@ public function testFailedAuthorizeRequest(): void
         $this->assertSame('The authorization grant type is not supported by the authorization server.', $jsonResponse['error_description']);
         $this->assertSame('Check that all required parameters have been provided', $jsonResponse['hint']);
     }
+
+    public function testUnathorizedImplicitRequest(): void
+    {
+        $this->loginUser();
+
+        $this->client->request(
+            'GET',
+            '/authorize',
+            [
+                'client_id' => FixtureFactory::FIXTURE_CLIENT_FIRST,
+                'response_type' => 'token',
+                'state' => 'foobar',
+            ]
+        );
+
+        $response = $this->client->getResponse();
+
+        $this->assertSame(302, $response->getStatusCode());
+        $redirectUri = $response->headers->get('Location');
+
+        $this->assertStringStartsWith(FixtureFactory::FIXTURE_CLIENT_FIRST_REDIRECT_URI, $redirectUri);
+        $fragment = [];
+        parse_str(parse_url($redirectUri, \PHP_URL_FRAGMENT), $fragment);
+        $this->assertArrayHasKey('error', $fragment);
+        $this->assertArrayHasKey('error_description', $fragment);
+        $this->assertArrayHasKey('state', $fragment);
+        $this->assertEquals('access_denied', $fragment['error']);
+        $this->assertEquals('foobar', $fragment['state']);
+    }
 }