Oauth Callback personalisation

[eMerzh]

Altair Supports Oauth which is great,
but you can't customize the callback URL.
Usually Oauth app check that the callback matches what you define in the app

Describe the solution you'd like
Be able to customize it, even though altair doens't really go there

Describe alternatives you've considered
change the app settings: it's not really practical and often cannot be done

[imolorhe]

How would it work if it is customizable? The fixed url has the necessary logic to retrieve and send the response back to the app. The only way I think it can work is in the desktop app by eavesdropping on the navigation on the opened page and retrieving the token

[eMerzh]

In insomnia for example, you can enter any url, the oauth window will listen to redirect to that url and finish the flow with that

[manjaycoder]

please assign me this issue

[manjaycoder]

fix(oauth): accept external callback redirects and allow custom callback URL in UI
Fix OAuth flow to support custom callback URLs and allow callback pages to send the redirect back via postMessage.

Changes:

• Allow messages from the configured redirectUri origin and parse posted redirect URLs in the OAuth popup flow.
• Make Callback URL editable in the OAuth UI and add a help snippet for web-hosted callback pages.
• Allow AUTHORIZATION_CODE messages from callback pages in the login-redirect helper (strict origin whitelist remains for other message types).

How to test:

1. pnpm install
2. pnpm -w build
3. Run the app (web or electron) and in Authorization -> OAuth2 set the Callback URL to a test page you host (add the postMessage snippet shown in the UI to that page).
4. Register the same callback in your OAuth provider and run the flow.

Security note: Only AUTHORIZATION_CODE messages are accepted from arbitrary origins; all other messages still require known valid origins

[imolorhe]

@manjaycoder I've assigned it to you.

[imolorhe]

@manjaycoder let me know when you intend to pick this up

[manjaycoder]

Yes, I’m ready to take this on. I’ll start working on it today

[imolorhe]

I'll recommend rebasing if you have a branch already, or pull latest master before you start as there have been many recent changes