fix(endpoint-auth): iss in authorization response should match issuer provided by metadata endpoint

paulrobertlloyd · paulrobertlloyd · commit f43ddfd46dbd · 2025-03-29T18:54:31.000Z
diff --git a/packages/endpoint-auth/lib/controllers/consent.js b/packages/endpoint-auth/lib/controllers/consent.js
@@ -47,6 +47,8 @@ export const consentController = {
    * @see {@link https://indieauth.spec.indieweb.org/#authorization-response}
    */
   post(request, response) {
+    const { application } = request.app.locals;
+
     let scope = request.body?.scope;
     const {
       client_id,
@@ -90,7 +92,7 @@ export const consentController = {
     // Authorization response
     const redirect = new URL(redirect_uri);
     redirect.searchParams.set("code", code);
-    redirect.searchParams.set("iss", client_id);
+    redirect.searchParams.set("iss", application.url);
     redirect.searchParams.set("state", state);
 
     // If client sent optional `me` value  in initial authorization request,
diff --git a/packages/endpoint-auth/test/integration/200-metadata.js b/packages/endpoint-auth/test/integration/200-metadata.js
@@ -13,10 +13,11 @@ describe("endpoint-auth GET /auth/metadata", () => {
       .get("/auth/metadata")
       .set("accept", "application/json");
     const result = response.body;
+    const { host, protocol } = new URL(response.request.url);
 
     assert.ok(result.authorization_endpoint);
     assert.equal(result.code_challenge_methods_supported[0], "S256");
-    assert.ok(result.issuer);
+    assert.equal(result.issuer, `${protocol}//${host}`);
     assert.equal(result.response_types_supported[0], "code");
     assert.ok(result.scopes_supported);
     assert.ok(result.service_documentation);
diff --git a/packages/endpoint-auth/test/integration/302-consent-submit-authenticate-with-me.js b/packages/endpoint-auth/test/integration/302-consent-submit-authenticate-with-me.js
@@ -27,17 +27,20 @@ describe("endpoint-auth POST /auth/consent", () => {
   });
 
   it("Returns 302 submitting authenticated user", async () => {
-    const result = await request
+    const response = await request
       .post("/auth/consent")
       .type("form")
       .query({ request_uri: `urn:ietf:params:oauth:request_uri:${reference}` })
       .send({ password: "foo" });
+    const { host, protocol } = new URL(response.request.url);
+    const issuer = encodeURIComponent(`${protocol}//${host}`);
 
-    assert.equal(result.status, 302);
+    assert.equal(response.status, 302);
     assert.match(
-      result.headers.location,
+      response.headers.location,
       /code=(.*)&iss=(.*)&state=(.*)&me=(.*)/,
     );
+    assert.ok(response.headers.location.includes(`iss=${issuer}`));
   });
 
   after(() => server.close());
