fix(oidc): preserve OIDC session params across mid-flow page refreshes - #1470
Draft
ruvenzx wants to merge 2 commits into
Draft
fix(oidc): preserve OIDC session params across mid-flow page refreshes#1470ruvenzx wants to merge 2 commits into
ruvenzx wants to merge 2 commits into
Conversation
When a user refreshes the page mid-flow, all URL params (including state_id, sso_app_id, oidc_error_redirect_uri, etc.) are lost, causing the Descope SDK to start a new OIDC session with no redirect context. Without state_id in particular, the SDK cannot look up the original authorization request and onSuccessRedirectUrl is never produced. Adds initOidcSession() called synchronously in index.tsx before React renders: saves all non-transient URL params to sessionStorage when sso_app_id is present, and restores them into the URL via replaceState on refresh so the SDK reconnects to the existing OIDC session. Calls clearOidcSession() in onSuccess to prevent stale params from leaking into unrelated visits within the same tab. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a user refreshes the page mid-flow, all URL params (including state_id, sso_app_id, oidc_error_redirect_uri, etc.) are lost, causing the Descope SDK to start a new OIDC session with no redirect context. Without state_id in particular, the SDK cannot look up the original authorization request and onSuccessRedirectUrl is never produced.
Adds initOidcSession() called synchronously in index.tsx before React renders: saves all non-transient URL params to sessionStorage when sso_app_id is present, and restores them into the URL via replaceState on refresh so the SDK reconnects to the existing OIDC session. Calls clearOidcSession() in onSuccess to prevent stale params from leaking into unrelated visits within the same tab.
Related Issues
related to https://github.com/descope/etc/issues/15556
Description
💬 A few sentences describing the overall goals of the pull request's commits.
Screenshots
📺🔫 All of the UI influenced by this PR
Must