Merge pull request #4068 from ProjectMirador/3902-src-encoding

URL-encoding access token service source url; fixes #3902
ProjectMirador · Jan 7, 2025 · 1c79e24 · 1c79e24
2 parents 5daa657 + bff7e8f
commit 1c79e24
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/__tests__/src/components/AccessTokenSender.test.js b/__tests__/src/components/AccessTokenSender.test.js
@@ -22,7 +22,7 @@ describe('AccessTokenSender', () => {
   it('renders properly', () => {
     const { container } = createWrapper({ url: 'http://example.com' });
 
-    expect(container.querySelector('iframe')).toHaveAttribute('src', 'http://example.com?origin=http://localhost&messageId=http://example.com'); // eslint-disable-line testing-library/no-node-access, testing-library/no-container
+    expect(container.querySelector('iframe')).toHaveAttribute('src', 'http://example.com/?origin=http%3A%2F%2Flocalhost&messageId=http%3A%2F%2Fexample.com'); // eslint-disable-line testing-library/no-node-access, testing-library/no-container
   });
 
   it('triggers an action when the iframe sends a message', () => {

diff --git a/src/components/AccessTokenSender.js b/src/components/AccessTokenSender.js
@@ -12,13 +12,17 @@ export function AccessTokenSender({ handleAccessTokenMessage, url = undefined })
 
   if (!url) return null;
 
+  const src = new URL(url);
+  src.searchParams.append('origin', window.origin);
+  src.searchParams.append('messageId', url);
+
   /**
   login, clickthrough/kiosk open @id, wait for close
   external, no-op
   */
   return (
     <IIIFIFrameCommunication
-      src={`${url}?origin=${window.origin}&messageId=${url}`}
+      src={src.toString()}
       title="AccessTokenSender"
       handleReceiveMessage={onReceiveAccessTokenMessage}
     />