Fix refresh implementation and closes hapijs#191 and hapijs#206

Lois Desplat · Lois Desplat · commit 976583160a80 · 2016-04-23T12:17:58.000-04:00
diff --git a/lib/oauth.js b/lib/oauth.js
@@ -197,13 +197,16 @@ exports.v2 = function (settings) {
         // Authorization callback
 
         state = request.state[cookie];
-		if (!state) {
-            if (request.query && request.query.refresh === 1) {
+        if (!state) {
+            if (request.query.refresh) {
                 return reply(Boom.internal('Missing ' + name + ' request token cookie'));
-            } else {
-                var url = request.connection.info.protocol + '://' + request.info.host + request.url.path + '&refresh=1';
-                return reply('<html><head><meta http-equiv="refresh" content="0;URL=\'' + url + '\'"></head><body></body></html>');
             }
+
+            // Workaround for some browsers where due to CORS and the redirection method,
+            // it will not send the state cookie along until the request comes directly from the same domain
+            const newQuery = Object.assign({}, request.url.query, { refresh: 1 });
+            const refreshUrl = internals.location(request, protocol, settings.location) + '?' + internals.queryString(newQuery);
+            return reply(`<html><head><meta http-equiv="refresh" content="0;URL="${refreshUrl}"></head><body></body></html>`);
         }
 
         reply.unstate(cookie);
diff --git a/test/oauth.js b/test/oauth.js
@@ -1471,7 +1471,7 @@ describe('Bell', () => {
             });
         });
 
-        it('errors on missing cookie in token step', (done) => {
+        it('refreshes & errors on missing cookie in token step', (done) => {
 
             const mock = new Mock.V2();
             mock.start((provider) => {
@@ -1511,11 +1511,17 @@ describe('Bell', () => {
                         mock.server.inject(res.headers.location, (mockRes) => {
 
                             expect(mockRes.headers.location).to.contain('http://localhost:80/login?code=1&state=');
-
                             server.inject(mockRes.headers.location, (response) => {
 
-                                expect(response.statusCode).to.equal(500);
-                                mock.stop(done);
+                                expect(response.statusCode).to.equal(200);
+                                const newLocation = mockRes.headers.location + '&refresh=1';
+                                expect(response.payload).to.contain(newLocation);
+
+                                server.inject(newLocation, (errorResponse) => {
+
+                                    expect(errorResponse.statusCode).to.equal(500);
+                                    mock.stop(done);
+                                });
                             });
                         });
                     });
