[SOLVED] Is there a way to remove the iss query param from the banno redirect url?

Is there a way to remove the iss query param from the banno redirect url?

After we've hit the initial https://digital.garden-fi.com/a/consumer/api/v0/oidc/auth we are redirected back to our URL, example:

https://dev2offers.cmgdlx.com/cnx/oauth2?tid=75B94B7E-E60D-4CB6-BBAC-E85949B4CA0E&code=j7vzsAaDJEqL2mom1Uc_l-GgjFexVuRksGNM17XpQ47&state=8BADE3FC-7859-4BF7-9B2C-5FAEB8FD2A2C&iss=https%3A%2F%2Fdigital.garden-fi.com%2Fa%2Fconsumer%2Fapi%2Fv0%2Foidc

We have a rule in our WAF to block any off domain link. So the: iss=https%3A%2F%2Fdigital.garden-fi.com%2Fa%2Fconsumer%2Fapi%2Fv0%2Foidc is triggering that policy and not allowing the user to authenticate.

Is there any way to disable that from being returned as a query param?

Solution

The iss (issuer) parameter you're seeing in the redirect URL is part of the OAuth 2.0 Authorization Server Issuer Identification extension, standardized in RFC 9207. It’s included in the authorization response to protect against mix-up attacks, where a client might get confused about which authorization server responded.

This parameter is not optional.