pyobs-auth 2.0.0.dev2__tar.gz → 2.0.0.dev3__tar.gz

{pyobs_auth-2.0.0.dev2 → pyobs_auth-2.0.0.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pyobs-auth
-Version: 2.0.0.dev2
+Version: 2.0.0.dev3
 Summary: Shared Keycloak/OIDC authentication client for pyobs web services
 Author-email: Tim-Oliver Husser <thusser@uni-goettingen.de>
 License-Expression: MIT

{pyobs_auth-2.0.0.dev2 → pyobs_auth-2.0.0.dev3}/pyobs_auth/views.py

@@ -29,7 +29,9 @@ class LoginView(View):
 
         request.session[SESSION_STATE_KEY] = authorization.state
         request.session[SESSION_CODE_VERIFIER_KEY] = authorization.code_verifier
-        request.session[SESSION_NEXT_KEY] = request.GET.get("next", "/")
+        # `or "/"` (not just a dict default) because `?next=` with an empty value is a present-but-
+        # falsy key - `.get("next", "/")` alone would return "" instead of falling back to "/".
+        request.session[SESSION_NEXT_KEY] = request.GET.get("next") or "/"
 
         return HttpResponseRedirect(authorization.url)
 
@@ -44,7 +46,7 @@ class CallbackView(View):
         state = request.GET.get("state")
         expected_state = request.session.pop(SESSION_STATE_KEY, None)
         code_verifier = request.session.pop(SESSION_CODE_VERIFIER_KEY, None)
-        next_url = request.session.pop(SESSION_NEXT_KEY, "/")
+        next_url = request.session.pop(SESSION_NEXT_KEY, "/") or "/"
 
         if not code or not state or not code_verifier or state != expected_state:
             return HttpResponseBadRequest("Invalid or expired login state")

{pyobs_auth-2.0.0.dev2 → pyobs_auth-2.0.0.dev3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pyobs-auth"
-version = "2.0.0.dev2"
+version = "2.0.0.dev3"
 description = "Shared Keycloak/OIDC authentication client for pyobs web services"
 authors = [{ name = "Tim-Oliver Husser", email = "thusser@uni-goettingen.de" }]
 requires-python = ">=3.11"