feat: add followRedirects option to follow 30x responses - #506
Open
ChrisZieba wants to merge 1 commit into
Open
Conversation
Add a `followRedirects` client option (default `false`) that, when enabled, follows 3xx redirect responses from the JWKS endpoint instead of treating them as errors. The request wrapper now resolves the `Location` header against the current URL so both absolute and relative redirects are supported, and caps the redirect chain at 10 hops to guard against loops. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds a
followRedirectsclient option (defaultfalse) that, when enabled, follows 3xx redirect responses from the JWKS endpoint instead of treating them as errors.Previously any 3xx status fell through the
statusCode < 200 || statusCode >= 300check in the request wrapper and was rejected as an HTTP error. WithfollowRedirects: true, the wrapper now follows theLocationheader to the final response.Changes
src/wrappers/request.js— refactored the request into a recursivemakeRequest(uri, redirectCount)helper. On a 3xx response with aLocationheader (andfollowRedirectsenabled) it drains the redirect body, resolves the location against the current URL (so both absolute and relative redirects work), and re-issues the request reusing the same headers / timeout / agent. The chain is capped at 10 hops to guard against redirect loops.src/JwksClient.js— addedfollowRedirects: falseto the default options and threaded it through to therequest()call ingetKeys().index.d.ts— addedfollowRedirects?: booleantoOptionsBase.README.md— documented the new option.tests/request.tests.js— added coverage for: following an absolute 30x redirect, following a relative redirect, not following when disabled, and the max-redirects guard.Behavior / compatibility
Default is
false, so existing behavior is unchanged — a 3xx still surfaces as an error unless the option is opted into.Testing
npm run lint— cleannpm test— 94 JS tests passing (incl. 4 new redirect tests) + 3 TS tests passing