fix: harden OIDC auth without breaking existing configs by igoroctaviano · Pull Request #406 · ImagingDataCommons/slim

igoroctaviano · 2026-08-03T13:19:49Z

Summary

Harden OIDC on the existing oidc-client stack so current public configs (including grantType: "implicit") keep working with no config or IdP redirect URI changes.
Restore deep links after login via the OIDC state parameter (removes brittle slim_path / slim_search localStorage). Warm sessions no longer re-apply a stale return URL.
On DICOMweb 401: try silent renew first, then interactive login with return URL. The reauth guard stays set once an IdP redirect starts (avoids concurrent-401 races). After a successful in-page renew, routed views remount so failed requests refetch with the new token.
Silent renew reuses the already-registered app redirect URI; iframe callbacks (success or IdP errors like login_required) complete in index.tsx and never mount the React SPA, so they cannot corrupt parent OIDC sessionStorage.
Keep Authorization headers consistent; enable logout even without endSessionEndpoint (local session clear fallback).
isSafeReturnUrl / isOidcAuthorizeCallbackUrl helpers with unit tests.

Compatibility / non-regression

Still depends on oidc-client@^1.11.5 (not oidc-client-ts).
public/config/*.js unchanged; implicit and code response types both supported as before.
No new OAuth redirect URIs required at the IdP.
PKCE / oidc-client-ts migration intentionally deferred (would break implicit deployments).

Test plan

With an existing implicit config (grantType: "implicit"), open a deep study URL, log in, and confirm you return to the same study (not /).
Warm session: with a valid stored user, open / and confirm you are not redirected to a previous study URL.
Confirm auth query/hash params are cleared after the callback.
Force / wait for token expiry leading to 401s: silent renew refreshes and the view recovers without a full page reload when renew succeeds.
If silent renew fails (login_required), interactive login restores the current route; the renew iframe must not boot Slim; concurrent 401s should not start multiple IdP redirects.
Logout works with and without endSessionEndpoint.
Confirm public/config/*.js files are unchanged.

deepsource-io · 2026-08-03T13:21:30Z

DeepSource Code Review

We reviewed changes in 62110e3...d5a529f on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Aug 18, 2026 3:31p.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

github-actions · 2026-08-03T13:22:10Z

Visit the preview URL for this PR (updated for commit d5a529f):

https://idc-external-006--pr406-feat-oidc-auth-harde-0za8mqbo.web.app

_{(expires Tue, 25 Aug 2026 15:33:15 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: 88aacecd98ba54d2f9c8d201a9444e43d1ad8307}

github-actions · 2026-08-14T16:44:53Z

📦 Firebase Preview - Using Published DMV

This preview is using the published dicom-microscopy-viewer from package.json:


Version	`^0.48.23`

To link a DMV branch for testing (requires an open PR in DMV):

Add dmv-branch: <branch-name> to the PR description, OR

Use the same branch name in both repos (automatic matching)

github-actions · 2026-08-14T16:47:51Z

📦 Firebase Preview - Using Published DMV

This preview is using the published dicom-microscopy-viewer from package.json:


Version	`^0.48.23`

To link a DMV branch for testing (requires an open PR in DMV):

Add dmv-branch: <branch-name> to the PR description, OR

Use the same branch name in both repos (automatic matching)

Migrate to oidc-client-ts with auth-code+PKCE by default while keeping grantType: "implicit" working unchanged. Restore deep links via OIDC state, add silent renew, and recover from 401 without dropping the route.

Drop the oidc-client-ts migration that broke grantType: "implicit". Retain state-based deep-link restore, safer 401 renew, and silent renew via the existing redirect_uri with an iframe bootstrap path.

Keep the interactive reauth guard set after IdP redirect starts so concurrent 401s cannot overwrite OIDC state, and remount routed views after silent renew so failed requests refetch with the new token.

Detect IdP error callbacks (e.g. login_required) as renew iframe responses and skip React mount so the iframe cannot corrupt parent OIDC sessionStorage during interactive re-auth fallback.

- Replace for-in loops with Object.keys() iteration (JS-0051) - Add skipcq for fire-and-forget async auth bootstrap (JS-0098) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

sonarqubecloud · 2026-08-18T15:31:59Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-08-18T15:32:51Z

📦 Firebase Preview - Using Published DMV

This preview is using the published dicom-microscopy-viewer from package.json:


Version	`^0.48.22`

To link a DMV branch for testing (requires an open PR in DMV):

Add dmv-branch: <branch-name> to the PR description, OR

Use the same branch name in both repos (automatic matching)

igoroctaviano and others added 5 commits August 18, 2026 12:22

fix: harden OIDC auth without breaking existing configs

2d2aab8

Migrate to oidc-client-ts with auth-code+PKCE by default while keeping grantType: "implicit" working unchanged. Restore deep links via OIDC state, add silent renew, and recover from 401 without dropping the route.

fix: keep oidc-client for non-breaking auth hardening

ae97290

Drop the oidc-client-ts migration that broke grantType: "implicit". Retain state-based deep-link restore, safer 401 renew, and silent renew via the existing redirect_uri with an iframe bootstrap path.

fix: harden mid-session OIDC reauth against races and stale UI

79660d0

Keep the interactive reauth guard set after IdP redirect starts so concurrent 401s cannot overwrite OIDC state, and remount routed views after silent renew so failed requests refetch with the new token.

fix: never boot SPA inside OIDC silent-renew error iframes

63fb640

Detect IdP error callbacks (e.g. login_required) as renew iframe responses and skip React mount so the iframe cannot corrupt parent OIDC sessionStorage during interactive re-auth fallback.

fix: resolve DeepSource for-in and void issues

dd82416

- Replace for-in loops with Object.keys() iteration (JS-0051) - Add skipcq for fire-and-forget async auth bootstrap (JS-0098) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

igoroctaviano force-pushed the feat/oidc-auth-hardening branch from c217eff to dd82416 Compare August 18, 2026 15:22

fix: sync lockfile with package.json dependencies

d5a529f

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

igoroctaviano merged commit 0f2c919 into master Aug 18, 2026
8 checks passed

Navigation Menu

Uh oh!

fix: harden OIDC auth without breaking existing configs - #406

fix: harden OIDC auth without breaking existing configs#406
igoroctaviano merged 6 commits into
masterfrom
feat/oidc-auth-hardening

igoroctaviano commented Aug 3, 2026 •

edited

Loading

Uh oh!

deepsource-io Bot commented Aug 3, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 3, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 14, 2026

Uh oh!

github-actions Bot commented Aug 14, 2026

Uh oh!

sonarqubecloud Bot commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

igoroctaviano commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Compatibility / non-regression

Test plan

Uh oh!

deepsource-io Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

github-actions Bot commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 14, 2026

📦 Firebase Preview - Using Published DMV

Uh oh!

github-actions Bot commented Aug 14, 2026

📦 Firebase Preview - Using Published DMV

Uh oh!

sonarqubecloud Bot commented Aug 18, 2026

Quality Gate passed

Uh oh!

github-actions Bot commented Aug 18, 2026

📦 Firebase Preview - Using Published DMV

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

igoroctaviano commented Aug 3, 2026 •

edited

Loading

deepsource-io Bot commented Aug 3, 2026 •

edited

Loading

github-actions Bot commented Aug 3, 2026 •

edited

Loading