Link to DID webpage only works if already authenticated due to callbackUrl decoding

[barskern]

Description

Following links directly to a DID (if someone copied the link from their browser to share) only works if the browser is already authenticated against Rucio. If the user clicking the link is not already authenticated, the DID name path component (which is URI-encoded) is decoded somehow during the 307 redirects and hence the resulting callbackUrl passed to the login page is invalid. This causes the link to show a 404 after the login flow is completed.

Following images show the path component being directly encoded before hitting the 307 redirects from Rucio to perform login. The first screenshot shows the link in the request before the first redirect to the /api/auth-endpoint.

The second screenshot show the decoded component and hence invalid URL in the callbackUrl parameter.

Steps to reproduce

1. Ensure you are logged out of any Rucio instance web API.
2. Follow a link to a DID webpage, such as:

https://xxx.rucioit.cern.ch/did/page/<scope>/<uri-encoded-name>

3. Follow the login prompts.
4. Get the 404 error due to invalid callbackUrl

Rucio Version

Client: WebUI, Server: 39.4.0

Additional Information

No response

[bari12]

I am moving this to the webui repo, where @maany can comment.

[maany]

Thanks for reporting @barskern . I will try to recreate this and get back with a fix or questions.