Less strict URL checking in redirect URLs list

Svenito commented

2025-09-23 08:58:43 -05:00

(Migrated from github.com)

As per Immich docs (https://immich.app/docs/administration/oauth/) a URL in the format app.immich:///oauth-callback is required for OAuth in the mobile app. This is currently not possible with VoidAuth as it rejects it with "redirect_uris must only contain web uris".

Describe the solution you'd like:

Redirect URLs should allow inclusion of such mobile app URLs to allow SSO on devices as well as on web

### Is your feature request related to a problem? Please describe: As per Immich docs (https://immich.app/docs/administration/oauth/) a URL in the format `app.immich:///oauth-callback` is required for OAuth in the mobile app. This is currently not possible with VoidAuth as it rejects it with "redirect_uris must only contain web uris". ### Describe the solution you'd like: Redirect URLs should allow inclusion of such mobile app URLs to allow SSO on devices as well as on web

elliott-parkinson commented

2025-09-23 14:31:54 -05:00

(Migrated from github.com)

To add that this issue also effects all of the available apps for audiobookshelf and means I cannot sign into those whilst using voidauth as my identity provider either.

Looking at how other authentication providers handle this, they appear to just not care and not have strict url checking.

To add that this issue also effects all of the available apps for audiobookshelf and means I cannot sign into those whilst using voidauth as my identity provider either. Looking at how other authentication providers handle this, they appear to just not care and not have strict url checking.

Svenito commented

2025-09-23 15:05:21 -05:00

(Migrated from github.com)

However the docs actually list immich and its app URL https://voidauth.app/#/OIDC-Guides?id=-immich

But I double checked and it's the app URL that causes the issue. Which will be the same for all apps as @elliott-parkinson said.

Not sure if strict redirect url checking is eveb necessary as these URLs are added by the admin and wouldn't be under control by a third party for malicious purposes.

However the docs actually list immich and its app URL https://voidauth.app/#/OIDC-Guides?id=-immich But I double checked and it's the app URL that causes the issue. Which will be the same for all apps as @elliott-parkinson said. Not sure if strict redirect url checking is eveb necessary as these URLs are added by the admin and wouldn't be under control by a third party for malicious purposes.

notquitenothing commented

2025-09-23 17:07:47 -05:00

(Migrated from github.com)

Thanks for opening an issue!

On your VoidAuth OIDC Client page for your client app, can you try selecting native from the Application Type drop-down under the area to add Redirect URLs? If you do not see the drop-down, you may need to update your VoidAuth version using something like docker compose pull voidauth and docker compose up -d voidauth.

Let me know if that does/doesn't work to fix the issue

Thanks for opening an issue! On your VoidAuth OIDC Client page for your client app, can you try selecting `native` from the `Application Type` drop-down under the area to add Redirect URLs? If you do not see the drop-down, you may need to update your VoidAuth version using something like `docker compose pull voidauth` and `docker compose up -d voidauth`. Let me know if that does/doesn't work to fix the issue

Svenito commented

2025-09-24 03:32:45 -05:00

(Migrated from github.com)

Thank you for the reply. Yes that works, and having re-read the doc page I linked I can now see it says "select native". Although this works, the issue I have (but can work around) is that I have my immich hosted in my Tailscale network and thus only have http paths to the instance. I can get around this though

👍 1

notquitenothing commented

2025-09-24 22:26:31 -05:00

(Migrated from github.com)

Unfortunately this seems to be a limitation (on purpose, possibly to conform to OIDC spec?) of the OIDC provider library I use in VoidAuth, node-oidc-provider. It seems you can either have insecure protocols with the web Application Type, or arbitrary app protocols with native.

A possible user experience improvement in VoidAuth would be detecting app protocol URLs and automatically switching to the native Application Type if possible.

Unfortunately this seems to be a limitation (on purpose, possibly to conform to OIDC spec?) of the OIDC provider library I use in VoidAuth, [node-oidc-provider](https://github.com/panva/node-oidc-provider). It seems you can either have insecure protocols with the `web` Application Type, or arbitrary app protocols with `native`. A possible user experience improvement in VoidAuth would be detecting app protocol URLs and automatically switching to the `native` Application Type if possible.

❤️ 1

Rows
Columns

Less strict URL checking in redirect URLs list #128

Is your feature request related to a problem? Please describe:

Describe the solution you'd like: