Implicit OAuth flow is not working when the user is not logged in.

Question

Here is the URL I am trying to use:

https://stackexchange.com/oauth/dialog?client_id=120&scope=read_inbox,no_expiry&redirect_uri=https://stackexchange.com/oauth/login_success

This works perfectly when the user is logged in but when a user is not logged in, the following happens:

• A redirect to this page occurs:

  https://stackexchange.com/oauth/dialog?client_id=120&redirect_uri=https://stackexchange.com/oauth/login_success&scope=read_inbox,no_expiry&response_type=token&state=&returnurl=/oauth/dialog?client_id=120&redirect_uri=https%3a%2f%2fstackexchange.com%2foauth%2flogin_success&scope=read_inbox,no_expiry&response_type=token&state=

• After logging in to an OpenID provider, this page is displayed:

  https://stackexchange.com/oauth/dialog?client_id=120&redirect_uri=https%3a%2f%2fstackexchange.com%2foauth%2flogin_success&scope=read_inbox,no_expiry&response_type=token&state=

• Clicking "reject" leads to this non-existent page:

  https://stackexchange.com/oauth/https://stackexchange.com/oauth/login_success#error=access_denied&error_description=user+denied+this+authentication+request

What am I doing wrong?

Answer 1

This should be fixed.

The rejection flow was using a slightly out of sync version of "send the consumer a response" code. That flow has been refactored to use the same path as approval now (though, obviously with a different payload), to avoid this situation in the future.