feat: add SkipAuthorization option for OIDC clients by Miista · Pull Request #988 · tinyauthapp/tinyauth

Miista · 2026-07-09T20:09:49Z

Problem

When a user logs in via OIDC, they are always shown a consent screen asking them to authorize the client. For trusted, self-hosted clients this is unnecessary friction — the user is effectively asked "do you trust your own app?" every time their session expires.

Fixes #878

Solution

Add a skipAuthorization boolean field to OIDCClientConfig. When set to true and the user is already authenticated, the authorize endpoint bypasses the consent screen and immediately issues the authorization code and redirects back to the client.

Configuration

Environment variable:

TINYAUTH_OIDC_CLIENTS_<NAME>_SKIPAUTHORIZATION=true

YAML:

oidc:
  clients:
    myapp:
      skipAuthorization: true

Notes

Only skips the consent screen if the user is already authenticated. If not authenticated, the normal login + consent flow applies.
The ticket is cleaned up immediately (same as the normal post-consent path).
Old sessions are deleted before issuing the code (same behaviour as authorizeComplete).

AI Disclosure

This pull request was developed with AI assistance (Claude). The implementation has been reviewed and is fully understood by the author.

Summary by CodeRabbit

New Features
- Added a skipAuthorization option for OIDC clients to bypass the consent/authorization screen when the user is already signed in and no login is forced.
- For supported cases, authorization now completes immediately and redirects back to the requesting app with the authorization response (code and state).
Behavior Updates
- When max_age indicates the existing session is too old, login may be required even if skipAuthorization is enabled.

coderabbitai · 2026-07-09T20:10:18Z

📝 Walkthrough

Walkthrough

Adds SkipAuthorization to OIDC client config and updates authorize so authenticated requests can complete directly with an authorization code when consent skipping is enabled.

Changes

Skip Authorization Flow

Layer / File(s)	Summary
Config field for skip authorization `internal/model/config.go`	Adds `SkipAuthorization bool` to `OIDCClientConfig` with YAML key `skipAuthorization,omitempty`.
Authorization redirect path `internal/controller/oidc_controller.go`	Derives `forceLogin` from prompts and session age, then either returns a direct `redirect_uri` response with `code` and `state` for skip-authorization clients or continues to the consent screen flow.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

tinyauthapp/tinyauth#907: Related redirect-response construction in internal/controller/oidc_controller.go.
tinyauthapp/tinyauth#923: Related OIDC authorization flow changes in internal/controller/oidc_controller.go.

Suggested reviewers: scottmckendry

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR adds a per-client skipAuthorization setting and bypasses the consent screen for authenticated users, matching issue `#878`.
Out of Scope Changes check	✅ Passed	The changes stay focused on OIDC consent skipping and related authorize-flow handling, with no unrelated scope evident.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding a SkipAuthorization option for OIDC clients.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/controller/oidc_controller.go`:
- Around line 209-237: The SkipAuthorization flow in oidc_controller.go is
issuing a code before the existing re-authentication checks (`prompt=login` and
`max_age`) are evaluated. Update the authorize path around the
`controller.oidc.DeleteAuthorizeRequestTicket`, `CreateSub`, and `CreateCode`
logic so consent can still be skipped only after all login freshness
requirements have passed, and ensure the same fix is applied to the other
matching authorize branch referenced in the comment.
- Line 236: The redirect in the OIDC callback is appending a new query string
with “?” in OIDCController’s callback flow, which breaks redirect URIs that
already have existing parameters. Update the redirect construction to merge the
new callback parameters into the parsed RedirectURI’s existing query values
instead of concatenating raw strings, then encode them back before calling
c.Redirect. Use the OIDC controller callback logic and the req.RedirectURI
handling as the main places to adjust, and add the needed net/url import for
parsing and rebuilding the URL.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: cd115e3f-7d93-4130-9dbf-34f17de3bc0a

📥 Commits

Reviewing files that changed from the base of the PR and between 405d910 and a47ba05.

📒 Files selected for processing (2)

internal/controller/oidc_controller.go
internal/model/config.go

steveiliop56 · 2026-07-09T23:22:21Z

Hello @Miista.

There is an issue with this implementation. Setting one flag to disable the consent screen for every single user is a bad security choice. The users should be asked for approval at least once and then we can omit the consent screen. This effectively means that we will need some sort of state, either in the browser or in the database. Additionally, even in the case where the consent screen is skipped, the authorization should still follow the same route just with prompt=none. We already have the API endpoint for completing authorization, there is no need to duplicate code.

I will continue progress tracking for this feature in #989.

In any case, thank you for taking the time to work on this and we will definitely implement a way for the consent screen to be skipped in v5.2.0.

Miista · 2026-07-10T04:33:29Z

@steveiliop56 But the user is asked once the first time they log in?

We are literally only skipping if the current user is already authorized for the given application.

feat: add SkipAuthorization option for OIDC clients

a47ba05

dosubot Bot added the size:M This PR changes 30-99 lines, ignoring generated files. label Jul 9, 2026

coderabbitai Bot reviewed Jul 9, 2026

View reviewed changes

Comment thread internal/controller/oidc_controller.go Outdated

Comment thread internal/controller/oidc_controller.go Outdated

Miista added 4 commits July 9, 2026 22:20

fix: remove accidental alignment padding from OIDCClientConfig

70ede6b

fix: skip authorization only after prompt and max_age checks

d7b7396

fix: use url.Parse to safely merge callback query params

d0eb33b

fix: compute forceLogin before ticket creation and skip branch

dfb81ce

steveiliop56 closed this Jul 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat: add SkipAuthorization option for OIDC clients#988

feat: add SkipAuthorization option for OIDC clients#988
Miista wants to merge 5 commits into
tinyauthapp:mainfrom
Miista:feat/oidc-client-skip-authorization

Miista commented Jul 9, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 9, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

steveiliop56 commented Jul 9, 2026

Uh oh!

Miista commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

Miista commented Jul 9, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Configuration

Notes

AI Disclosure

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

steveiliop56 commented Jul 9, 2026

Uh oh!

Miista commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Miista commented Jul 9, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 9, 2026 •

edited

Loading