🐛 Bug Report: Trim operation is not performed on OIDC Callback URLs entry boxes #222

New Issue

OVERLORD · 2025-10-07T00:06:23+03:00

OVERLORD commented

2025-10-07 00:06:23 +03:00

Originally created by @Illuminati-Cow on GitHub.

Reproduction steps

Create a callback URL with a space at the end
Configure the client to use Pocket ID as an authenticator
Sign in to Pocket ID and attempt to authenticate with the client
Invalid Callback URL error

Expected behavior

The entry box should perform a trim operation at the very least, or a basic check for malformed URLs.

Actual Behavior

The URL with a space was accepted, and no warning was presented. Upon hitting the invalid callback, the appropriate error was presented.

Version and Environment

I performed additional testing, and the error only occurs if the malformed callback URL needs to be resolved. When putting spaces in unused callback URLs, no issue occurred. A trim operation on the URL entry boxes should cause no new issues and prevent user error.

Log Output

pocket-id | [GIN] 2025/05/13 - 07:09:25 | 400 | 967.791µs | 10.0.0.227 | POST "/api/oidc/authorize"
pocket-id | Error #01: invalid callback URL, it might be necessary for an admin to fix this

Originally created by @Illuminati-Cow on GitHub. ### Reproduction steps 1. Create a callback URL with a space at the end 2. Configure the client to use Pocket ID as an authenticator 3. Sign in to Pocket ID and attempt to authenticate with the client 4. Invalid Callback URL error ### Expected behavior The entry box should perform a trim operation at the very least, or a basic check for malformed URLs. ### Actual Behavior The URL with a space was accepted, and no warning was presented. Upon hitting the invalid callback, the appropriate error was presented. ### Version and Environment I performed additional testing, and the error only occurs if the malformed callback URL needs to be resolved. When putting spaces in unused callback URLs, no issue occurred. A trim operation on the URL entry boxes should cause no new issues and prevent user error. ### Log Output `pocket-id | [GIN] 2025/05/13 - 07:09:25 | 400 | 967.791µs | 10.0.0.227 | POST "/api/oidc/authorize"` `pocket-id | Error #01: invalid callback URL, it might be necessary for an admin to fix this`

OVERLORD added the bug label 2025-10-07 00:06:23 +03:00

OVERLORD closed this issue

2025-10-07 00:06:24 +03:00

OVERLORD commented

2025-10-07 00:06:26 +03:00

@stonith404 commented on GitHub:

Thanks, this should be fixed in 207da2ac6a and will be released in v1.0.0.

@stonith404 commented on GitHub: Thanks, this should be fixed in 207da2ac6a0aa1d3bd441095af1b47595f341be2 and will be released in `v1.0.0`.

OVERLORD referenced this issue

2025-10-07 00:24:26 +03:00

[PR #222] [MERGED] fix: user linking in ldap group sync #906

OVERLORD referenced this issue