After we've hit the initial we are redirected back to our URL, example:
;code=j7vzsAaDJEqL2mom1Uc_l-GgjFexVuRksGNM17XpQ47&state=8BADE3FC-7859-4BF7-9B2C-5FAEB8FD2A2C&iss=https%3A%2F%2Fdigital.garden-fi%2Fa%2Fconsumer%2Fapi%2Fv0%2Foidc
We have a rule in our WAF to block any off domain link. So the:
iss=https%3A%2F%2Fdigital.garden-fi%2Fa%2Fconsumer%2Fapi%2Fv0%2Foidc is triggering that policy and not allowing the user to authenticate.
Is there any way to disable that from being returned as a query param?
After we've hit the initial https://digital.garden-fi/a/consumer/api/v0/oidc/auth we are redirected back to our URL, example:
https://dev2offers.cmgdlx/cnx/oauth2?tid=75B94B7E-E60D-4CB6-BBAC-E85949B4CA0E&code=j7vzsAaDJEqL2mom1Uc_l-GgjFexVuRksGNM17XpQ47&state=8BADE3FC-7859-4BF7-9B2C-5FAEB8FD2A2C&iss=https%3A%2F%2Fdigital.garden-fi%2Fa%2Fconsumer%2Fapi%2Fv0%2Foidc
We have a rule in our WAF to block any off domain link. So the:
iss=https%3A%2F%2Fdigital.garden-fi%2Fa%2Fconsumer%2Fapi%2Fv0%2Foidc is triggering that policy and not allowing the user to authenticate.
Is there any way to disable that from being returned as a query param?
Share Improve this question asked 2 days ago Chris ReederChris Reeder 34 bronze badges1 Answer
Reset to default 0The iss (issuer) parameter you're seeing in the redirect URL is part of the OAuth 2.0 Authorization Server Issuer Identification extension, standardized in RFC 9207. It’s included in the authorization response to protect against mix-up attacks, where a client might get confused about which authorization server responded.
This parameter is not optional.