URL query parameters do not get removed in htu field

[joachimvh]

Search terms you've used

htu

Impacted package

Which packages do you think might be impacted by the bug ?

• solid-client-authn-core

Bug description

The htu field of the access token is generated here. Actual code of the removeHashUsernameAndPassword function is as follows:

function removeHashUsernameAndPassword(audience: string): string {
  const cleanedAudience = new URL(audience);
  cleanedAudience.hash = "";
  cleanedAudience.username = "";
  cleanedAudience.password = "";
  return cleanedAudience.toString();
}

The issue is that the above code does not clear the query parameters of the URL. http://example.com/?query remains unchanged after going through that function, but the htu parameter is defined as

The HTTP URI used for the request, without query and fragment parts

To Reproduce

See CommunitySolidServer/Recipes#3

Or just run the code above with any URL containing a query parameter.

Expected result

htu: http://example.com/

Actual result

htu: http://example.com/?query

[NSeydoux]

Thanks for reporting @joachimvh , we'll fix this soon.

[diegoaraujo]

Any news?

[ThisIsMissEm]

This was released in 1.11.4 and onwards, sorry we didn't follow up properly on this. We've also just done a fix for the iss parameter in #2103, which should be released soon-ish.

Closing as this is done.