diff --git a/src/core/oauth2-authorize.js b/src/core/oauth2-authorize.js index e20cdd3b594..06a6fa02d3a 100644 --- a/src/core/oauth2-authorize.js +++ b/src/core/oauth2-authorize.js @@ -8,6 +8,11 @@ export default function authorize ( { auth, authActions, errActions, configs, au let flow = schema.get("flow") let query = [] + // deleting old authorization code before new attempt if defined. + // At this stage we don't care about flow type. + // It fails silently if not defined yet + delete auth.code + switch (flow) { case "password": authActions.authorizePassword(auth) diff --git a/test/unit/core/oauth2-authorize.js b/test/unit/core/oauth2-authorize.js index b31faeb4b49..d69342d76f4 100644 --- a/test/unit/core/oauth2-authorize.js +++ b/test/unit/core/oauth2-authorize.js @@ -197,5 +197,22 @@ describe("oauth2", () => { authConfig3.authActions.authPopup.mockReset() }) + + it("should delete previous authorization code when using authorizationCode flow on each attempt", () => { + mockSchema.flow = "authorizationCode" + + authConfig.authConfigs.usePkceWithAuthorizationCodeGrant = true + + // Simulate a stale authorization code from a previous attempt + authConfig.auth.code = "mock_authorization_code" + + expect(authConfig.auth.code).toBe("mock_authorization_code") + + oauth2Authorize(authConfig) + expect(authConfig.auth.code).toBeUndefined() + + authConfig.authActions.authPopup.mockReset() + }) + }) })