Do not cache authenticated responses

README.md

@@ -34,7 +34,7 @@ This is 100% alpha software! PRs are welcome to improve the code.
 
 ~~There is NO admin configuration! You must use the API to configure the program!~~ Added by [strazto](https://github.com/strazto) in PR [#18](https://github.com/9p4/jellyfin-plugin-sso/pull/18) and [#27](https://github.com/9p4/jellyfin-plugin-sso/pull/27).
 
-**[This is for Jellyfin 10.8](https://github.com/9p4/jellyfin-plugin-sso/issues/3) and only on the Web UI!**
+**[This is for Jellyfin 10.8](https://github.com/9p4/jellyfin-plugin-sso/issues/3) and only on the Web UI and clients supporting [Quick Connect](https://jellyfin.org/docs/general/server/quick-connect)**
 
 **This README reflects the branch it is currently on! Switch tags to view version-specific documentation!**
 
@@ -91,16 +91,18 @@ The nightly build may have new features unavailable in other builds, but **be wa
 
 ## Examples
 
+**Note that you should add both "/r/" and "/redirect/" paths to your SSO provider's configuration!**
+
 ### Creating A Login Button On The Main Page
 
 In the Jellyfin administration UI, under "General", there is a "Branding" section. In that section, add the following code in the "Login disclaimer" block (replacing `PROVIDER_NAME` and the domain):
 
 ```html
-<a
-  href="https://jellyfin.example.com/sso/OID/start/PROVIDER_NAME"
-  class="raised cancel block emby-button"
-  >Sign in with SSO</a
->
+<form action="https://jellyfin.example.com/sso/OID/start/PROVIDER_NAME">
+  <button class="raised block emby-button button-submit">
+    Sign in with SSO
+  </button>
+</form>
 ```
 
 Then, add the following code in the "Custom CSS code" section:

SSO-Auth/Api/SSOController.cs

@@ -66,6 +66,7 @@ public class SSOController : ControllerBase
     // Actually a GET: https://github.com/IdentityModel/IdentityModel.OidcClient/issues/325
     [HttpGet("OID/r/{provider}")]
     [HttpGet("OID/redirect/{provider}")]
+    [ResponseCache(Location = ResponseCacheLocation.None, NoStore = true)]
     public async Task<ActionResult> OidPost(
         [FromRoute] string provider,
         [FromQuery] string state) // Although this is a GET function, this function is called `Post` for consistency with SAML
@@ -288,12 +289,21 @@ public class SSOController : ControllerBase
 
         if (config.Enabled)
         {
+            bool newPath = config.NewPath;
+            if (!isLinking)
+            {
+                newPath = Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase);
+                config.NewPath = newPath;
+            }
+
+            string redirectUri = GetRequestBase(config.SchemeOverride) + $"/sso/OID/{(newPath ? "redirect" : "r")}/" + provider;
+
             var options = new OidcClientOptions
             {
                 Authority = config.OidEndpoint?.Trim(),
                 ClientId = config.OidClientId?.Trim(),
                 ClientSecret = config.OidSecret?.Trim(),
-                RedirectUri = GetRequestBase(config.SchemeOverride) + $"/sso/OID/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "redirect" : "r")}/" + provider,
+                RedirectUri = redirectUri,
                 Scope = string.Join(" ", config.OidScopes.Prepend("openid profile")),
             };
             options.Policy.Discovery.ValidateEndpoints = false; // For Google and other providers with different endpoints
@@ -428,6 +438,7 @@ public class SSOController : ControllerBase
     /// <returns>A webpage that will complete the client-side flow.</returns>
     [HttpPost("SAML/p/{provider}")]
     [HttpPost("SAML/post/{provider}")]
+    [ResponseCache(Location = ResponseCacheLocation.None, NoStore = true)]
     public ActionResult SamlPost(string provider, [FromQuery] string relayState = null)
     {
         SamlConfig config;
@@ -514,6 +525,14 @@ public class SSOController : ControllerBase
 
         if (config.Enabled)
         {
+            bool newPath = config.NewPath;
+            if (!isLinking)
+            {
+                newPath = Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase);
+                config.NewPath = newPath;
+            }
+
+            string redirectUri = GetRequestBase(config.SchemeOverride) + $"/sso/SAML/{(newPath ? "post" : "p")}/" + provider;
             string relayState = null;
             if (isLinking)
             {
@@ -522,7 +541,7 @@ public class SSOController : ControllerBase
 
             var request = new AuthRequest(
                 config.SamlClientId.Trim(),
-                GetRequestBase(config.SchemeOverride) + $"/sso/SAML/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "post" : "p")}/" + provider);
+                redirectUri);
 
             return Redirect(request.GetRedirectUrl(config.SamlEndpoint.Trim(), relayState));
         }

SSO-Auth/Config/PluginConfiguration.cs

@@ -131,6 +131,11 @@ public class SamlConfig
     /// </summary>
     public string SchemeOverride { get; set; }
 
+    /// <summary>
+    /// Gets or sets a value indicating whether the new, more descriptive paths are to be used.
+    /// </summary>
+    public bool NewPath { get; set; }
+
     /// <summary>
     /// Gets or sets a mapping of canonical names from the provider to jellyfin user ids.
     /// </summary>
@@ -260,6 +265,11 @@ public class OidConfig
     /// </summary>
     public string SchemeOverride { get; set; }
 
+    /// <summary>
+    /// Gets or sets a value indicating whether the new, more descriptive paths are to be used.
+    /// </summary>
+    public bool NewPath { get; set; }
+
     /// <summary>
     /// Gets or sets a mapping of canonical names from the provider to jellyfin user ids.
     /// </summary>

build.yaml

@@ -1,7 +1,7 @@
 name: "SSO Authentication"
 guid: "505ce9d1-d916-42fa-86ca-673ef241d7df"
 imageUrl: "https://raw.githubusercontent.com/9p4/jellyfin-plugin-sso/main/img/logo.png"
-version: "3.5.2.1"
+version: "3.5.2.2"
 targetAbi: "10.8.0.0"
 framework: "net6.0"
 owner: "9p4"
@@ -15,6 +15,7 @@ artifacts:
   - "IdentityModel.OidcClient.dll"
   - "IdentityModel.dll"
 changelog: |
+  3.5.2.2: Fix linking page when using new paths
   3.5.2.1: Hotfix for SAML null checks
   3.5.2.0: Allow overriding the scheme used for generating URLs.
   3.5.1.1: Change iframe URL to point to the web UI instead of the root 

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1691218994,
-        "narHash": "sha256-46GJ5vLf9H+Oh7Jii2gJI9GATJHGbx2iQpon5nUSFPI=",
+        "lastModified": 1707205916,
+        "narHash": "sha256-fmRJilYGlB7VCt3XsdYxrA0u8e/K84O5xYucerUY0iM=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "0d2fb29f5071a12d7983319c2c2576be6a130582",
+        "rev": "8cc79aa39bbc6eaedaf286ae655b224c71e02907",
         "type": "github"
       },
       "original": {