authgear-server
authgear-server copied to clipboard
"Abort" in Auth Flow API
Sometimes in the UI, we want to provide a button for the user to abort the auth flow instead of dismissing the webpage. This helps the client app distinguish the abortion from other scenario where the auth flow is not completed.
In the case of #3469, in some cases, the reauth flow is initiated while the user have no matching authenticator to complete the reauth. A better UX would be put a button under the error message in the UI, so the user can redirect back to the client app instead of closing the browser.
The auth flow API should abort with error.
Currently we do not support aborting an authentication flow.
- The
finish_redirect_uri
(which is/oauth2/content
) always expect authentication info. We do not support redirect back to/oauth2/content
with an error generated by the client of authentication flow API.- The
finish_redirect_uri
is only present when the flow finishes. The client never know what URI they should use to abort the flow.Originally posted by @louischan-oursky in https://github.com/authgear/authgear-server/issues/3469#issuecomment-1803120119