When unauthenticated user opens URL of secure page on the client web site, he/she redirects to IdentifyServer for login and after successful login returns to the main page of the client(when using default implementation of client/IdentityServer).
Question on github RedirectUris with callback params does not work explains that it is a client responsibility to remember QueryString and has the recommendation:
If you need to maintain state across the redirects, then issue a cookie client side or pass data via the official state param. You generally want to use the state parameter as a pointer to locally persisted data - e.g. a cookie. Create a cookie with a random name - store whatever needs to be stored there - round trip the cookie name as the state parameter. Just putting data on state has the issue that someone could potentially modify the values on the way back.
The question Identity server 3 MVC client state parameter has similar recommendation:
Store state in your app about the redirect path you want after login. After IdSvr logs your user in and redirect back to your one well-known callback URI you then read that state to know where to send the user. IOW, keep track of that in store state in your app about the redirect path you want after login. If you put it in the ProtocolMessage.State , then be aware that someone can tamper with it. If you protect the state (sign/encrypt), then it's ok. It might be easier/safer to keep that state in your app.
As it is a very typical scenario, I hope that someone has an example of such implementation. Can anyone share the sample code/give a reference to some article?
More info about my particular scenario:
My client is web forms site with implementation similar to IdentityServer3.Samples WebFormsClient.
1.User opens https://mydomain/mypage?querystringparams
2.In Web.config I have
<authorization>
<deny users="?" />
</authorization>
3.In client Startup.cs the relevant setting
new OpenIdConnectAuthenticationOptions
{
Authority = "http://localhost:5000/",//IdentityServer4 Host
RedirectUri ="https://mydomain/"
}
4.On IdentityServer the relevant settings
new Client
{
RedirectUris = { "https://mydomain/" , "http://mydomain/" }
}
- After login user redirected to
https://mydomain/, but needs to be redirected tohttps://mydomain/mypage?querystringparams