[Question]: Authorizing with Google always gets configured redirectUrl does not match with the current url

[bigbasti]

What Version of the library are you using?
20.0.2

Question
I have set up login using google implicit flow (since code with PKCE is not supported by google) and I always get this when trying to login:

[DEBUG] google - Working with config 'google' using 'https://accounts.google.com'
[DEBUG] google - UrlService.isCallbackFromSts: configured redirectUrl does not match with the current url
[DEBUG] google - currentUrl to check auth with: 'http://localhost:4200/login-success#state=19c04b2ab4807ac6b940191b2cff824e51Lh8TUHE&access_token=ya29.a0AQQ_BDQVC...m7qrd9QWeXLg0207&token_type=Bearer&expires_in=3599&scope=email%20profile%20https://www.googleapis.com/auth/userinfo.email%20https://www.googleapis.com/auth/userinfo.profile%20openid&id_token=eyJhbGciOiJSUzI..._Dj-5lj47Wibbf0w2ak5QsbSn14yUwxkxpd4-Ipw&authuser=0&prompt=none'
[DEBUG] google - checkAuth completed. Firing events now. isAuthenticated: false

My config looks like this:

config: [{
    configId: "microsoft",
    ...
  },
  {
    configId: "google",
    authority: 'https://accounts.google.com',
    redirectUrl: window.location.origin + '/login-success',
    clientId: '9208...1ijohe.apps.googleusercontent.com',
    responseType: 'id_token token',
    scope: 'openid email profile',
    triggerAuthorizationResultEvent: true,
    postLoginRoute: "/",
    postLogoutRedirectUri: window.location.origin + '/unauthorized',
    startCheckSession: false,
    silentRenew: true,
    useRefreshToken: true,
    logLevel: LogLevel.Debug,
    historyCleanupOff: true
  }]

I initiate login using this:

this.oidcSecurityService.authorize("google");

Type of config in google is Web Application with these Redirect URLs (multiple versions just to try)

So why does the check always fail? What do I have to change?
I followed the code example for implicit flow with google in the docs.

[damienbod]

You can disable the validation using: strictIssuerValidationOnWellKnownRetrievalOff: false,

See #2136

[bigbasti]

Thanks for the quick reply @damienbod ,

I don't think the issues validation is the problem here - nevertheless I tried the setting but it dit not help.

The validation seems to check the configured url against the url logged above, which includes #state... in it. This check fails of course.

Is the url with the #state in it (in the log output) the url the expected behavior?
I would expect the auth parameters would be added with query params so localhost:4200?state=... isntead of localhost:4200#state=...

since you seem to be expecting query parameters here:

      const redirectUriUrlInstance = new URL(redirectUrl);
      const redirectUriWithoutQueryParams = this.getUrlWithoutQueryParameters(redirectUriUrlInstance).toString();
      const currentUrlWithoutQueryParams = this.getUrlWithoutQueryParameters(currentUrlInstance).toString();

Is this the root of the problem? Since the redirect url dows not use query params the logic does not filter them and the comparison fails?