c# - PKCE 代码流中重定向页面的必要性（IdentityServer4）

Question

使用带有 IdentityServer4 的 PKCE 代码流处理项目。我在 IS4 示例中发现了这种代码的平静：

[HttpPost]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Login(LoginInputModel model, string button)
{
    // check if we are in the context of an authorization request
    var context = await _interaction.GetAuthorizationContextAsync(model.ReturnUrl);

    // the user clicked the "cancel" button
    if (button != "login")
    {
        if (context != null)
        {
            // if the user cancels, send a result back into IdentityServer as if they 
            // denied the consent (even if this client does not require consent).
            // this will send back an access denied OIDC error response to the client.
            await _interaction.GrantConsentAsync(context, ConsentResponse.Denied);

            // we can trust model.ReturnUrl since GetAuthorizationContextAsync returned non-null
            if (await _clientStore.IsPkceClientAsync(context.ClientId))
            {
                // if the client is PKCE then we assume it's native, so this change in how to
                // return the response is for better UX for the end user.
                return View("Redirect", new RedirectViewModel { RedirectUrl = model.ReturnUrl });
            }

            return Redirect(model.ReturnUrl);
        }
        else
        {
            // since we don't have a valid context, then we just go back to the home page
            return Redirect("~/");
        }
    }

所以问题是我们为什么要显示重定向页面以及它如何改善用户体验？Redirec 视图上的唯一内容是消息“您现在正在返回到应用程序”。你能给我任何理由这样做或任何必要的情况吗？谢谢！

Answer 1

这对于具有自定义重定向 URI 的本机客户端非常有用。如果不需要，请随意删除代码。