{"action":"created","issue":{"url":"https://api.github.com/repos/atmos/warden-github/issues/48","labels_url":"https://api.github.com/repos/atmos/warden-github/issues/48/labels{/name}","comments_url":"https://api.github.com/repos/atmos/warden-github/issues/48/comments","events_url":"https://api.github.com/repos/atmos/warden-github/issues/48/events","html_url":"https://github.com/atmos/warden-github/pull/48","id":120485405,"number":48,"title":"Allow absolute redirect URIs","user":{"login":"aaw","id":274931,"avatar_url":"https://avatars.githubusercontent.com/u/274931?v=3","gravatar_id":"","url":"https://api.github.com/users/aaw","html_url":"https://github.com/aaw","followers_url":"https://api.github.com/users/aaw/followers","following_url":"https://api.github.com/users/aaw/following{/other_user}","gists_url":"https://api.github.com/users/aaw/gists{/gist_id}","starred_url":"https://api.github.com/users/aaw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaw/subscriptions","organizations_url":"https://api.github.com/users/aaw/orgs","repos_url":"https://api.github.com/users/aaw/repos","events_url":"https://api.github.com/users/aaw/events{/privacy}","received_events_url":"https://api.github.com/users/aaw/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-12-04T21:01:46Z","updated_at":"2015-12-06T21:03:41Z","closed_at":"2015-12-06T04:57:46Z","pull_request":{"url":"https://api.github.com/repos/atmos/warden-github/pulls/48","html_url":"https://github.com/atmos/warden-github/pull/48","diff_url":"https://github.com/atmos/warden-github/pull/48.diff","patch_url":"https://github.com/atmos/warden-github/pull/48.patch"},"body":"Currently, when you configure a `redirect_uri` that is an absolute URI, it has its path extracted and appended to the request domain to create the actual `redirect_uri` sent to Github. So, for example, if you have a `redirect_uri` of `test1.example.com/callback` but your app runs on `test2.example.com`, the `redirect_uri` sent to Github will be `test2.example.com/callback`. In most cases, this is the intended behavior, since Github doesn't allow redirect URIs that aren't extensions of the callback URI.\r\n\r\nThis patch allows `redirect_uri`s that are specified as absolute URIs to retain their domains, which allows, for example, OAuth schemes where a single app is the \"OAuth broker\" for several other apps. See http://stackoverflow.com/a/13841857 for an example. Using this patch, I was able to set up a single OAuth broker for many apps as described in the example.\r\n\r\nA little background to motivate why you would ever want to do this: we have a simple database admin app that takes, as configuration, a single connection url. For any database, say, db1, we expose this admin app on its own subdomain, e.g.,  `db1.example.com`. We have dozens of these admin apps and don't want to create a Github OAuth config for each individual one, so instead we set up a single `db.example.com` app as the \"broker\". When a request comes in to `db1.example.com` that needs authorization, it hits the Github OAuth endpoint with a `redirect_uri` of `db.example.com/auth/github/callback/db1.example.com`. When `db.example.com` gets the call back from Github on that path, it just fowards it (along with the `code` and `state`) back to `db1.example.com/auth/github/callback`, which checks the `state` and finishes the OAuth flow."},"comment":{"url":"https://api.github.com/repos/atmos/warden-github/issues/comments/162347215","html_url":"https://github.com/atmos/warden-github/pull/48#issuecomment-162347215","issue_url":"https://api.github.com/repos/atmos/warden-github/issues/48","id":162347215,"user":{"login":"atmos","id":38,"avatar_url":"https://avatars.githubusercontent.com/u/38?v=3","gravatar_id":"","url":"https://api.github.com/users/atmos","html_url":"https://github.com/atmos","followers_url":"https://api.github.com/users/atmos/followers","following_url":"https://api.github.com/users/atmos/following{/other_user}","gists_url":"https://api.github.com/users/atmos/gists{/gist_id}","starred_url":"https://api.github.com/users/atmos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/atmos/subscriptions","organizations_url":"https://api.github.com/users/atmos/orgs","repos_url":"https://api.github.com/users/atmos/repos","events_url":"https://api.github.com/users/atmos/events{/privacy}","received_events_url":"https://api.github.com/users/atmos/received_events","type":"User","site_admin":false},"created_at":"2015-12-06T21:03:41Z","updated_at":"2015-12-06T21:03:41Z","body":"Sorry for the blunt reply. I have no intention of supporting this type of approach. If you have multiple unique hostnames serving frontend traffic I'd suggest you setup separate applications or put them behind a load balancer."}}