Email Confirmation Incorrect Redirect URL (Angular) #2657

riley.trevillion.spatialhub4d created 2 years ago

Check the docs before asking a question: https://docs.abp.io/en/commercial/latest/ Check the samples, to see the basic tasks: https://docs.abp.io/en/commercial/latest/samples/index The exact solution to your question may have been answered before, please use the search on the homepage.

If you're creating a bug/problem report, please include followings:

ABP Framework version: v4.4.3
UI type: Angular
DB provider: EF Core
Tiered (MVC) or Identity Server Separated (Angular): no

Hello

We're encountering an issue with the confirm email address redirect URL where the user is being redirected to the aspnet server swagger UI API page instead of the angular client. Steps to reproduce this -

Enable the 'Require confirmed email' setting in Identity Management settings tab
Register a new user via the identity server / aspnet server login page (not the angular one) - it doesn't matter if it's a local user or a user via SSO provider like Google or Microsoft
When the user to prompted to verify their email address, the first automatic verification email that is sent contains a link which contains the correct 'returnUrl' query parameter. Confirming your email address via this will redirect you to the angular client as it is supposed to. Notice that https://localhost:44348 is the server and http://localhost:4200 url at the end is the angular client
If you click the 'Verify' button instead, the second email that is sent does NOT contain the returnUrl query parameter. This is the first issue that needs to be resolved
The next issue is that for some reason, even with returnUrl query parameter defined, the ConfirmUser.js file is referencing a field id that does not exist, so returnUrl value is null. I've had to manually define these fields as hidden fields to fix this issue.
Final issue is that the logic within the Volo Account module routes the user to the '~/' URL even with the returnUrl query parameter set when pressing the Verify button. the '~/' value seems to refer to address on server, not the angular client https://github.com/abpframework/abp/blob/dev/framework/src/Volo.Abp.AspNetCore.Mvc.UI/Volo/Abp/AspNetCore/Mvc/UI/RazorPages/AbpPageModel.cs I've resolved this by setting the RedirectUrl directly to the query parameter value (which will be the angular client if using my previous fixes). I'm aware this opens up some security issues around redirect hijacking, so an official fix from the ABP Team for this issue and the other issues I have mentioned would be appreciated.

Thanks

6 Answer(s)