@inrupt/solid-client-authn-browser 1.17.3 → 1.17.5

package/dist/index.js

@@ -82,7 +82,7 @@ class ClientAuthentication extends solidClientAuthnCore.ClientAuthentication {
             // If the user is providing a redirect IRI, it should not be modified, so
             // normalization only applies if we default to the current location (which is
             // a bad practice and should be discouraged).
-            const redirectUrl = (_a = options.redirectUrl) !== null && _a !== void 0 ? _a : oidcClientExt.removeOidcQueryParam(window.location.href);
+            const redirectUrl = (_a = options.redirectUrl) !== null && _a !== void 0 ? _a : oidcClientExt.normalizeCallbackUrl(window.location.href);
             if (!solidClientAuthnCore.isValidRedirectUrl(redirectUrl)) {
                 throw new Error(`${redirectUrl} is not a valid redirect URL, it is either a malformed IRI, includes a hash fragment, or reserved query parameters ('code' or 'state').`);
             }
@@ -139,24 +139,14 @@ class ClientAuthentication extends solidClientAuthnCore.ClientAuthentication {
         };
     }
     async cleanUrlAfterRedirect(url) {
-        const cleanedUpUrl = new URL(url);
-        cleanedUpUrl.searchParams.delete("state");
-        // For auth code flow
-        cleanedUpUrl.searchParams.delete("code");
-        // For implicit flow
-        cleanedUpUrl.searchParams.delete("id_token");
-        cleanedUpUrl.searchParams.delete("access_token");
-        // For login error
-        cleanedUpUrl.searchParams.delete("error");
-        cleanedUpUrl.searchParams.delete("error_description");
-        cleanedUpUrl.searchParams.delete("iss");
+        const cleanedUpUrl = solidClientAuthnCore.removeOpenIdParams(url).href;
         // Remove OAuth-specific query params (since the login flow finishes with
         // the browser being redirected back with OAuth2 query params (e.g. for
         // 'code' and 'state'), and so if the user simply refreshes this page our
         // authentication library will be called again with what are now invalid
         // query parameters!).
-        window.history.replaceState(null, "", cleanedUpUrl.toString());
-        while (window.location.href !== cleanedUpUrl.href) {
+        window.history.replaceState(null, "", cleanedUpUrl);
+        while (window.location.href !== cleanedUpUrl) {
             // Poll the current URL every ms. Active polling is required because
             // window.history.replaceState is asynchronous, but the associated
             // 'popstate' event which should be listened to is only sent on active