fix(nextjs,react): console noise on sign-out, social login and profile popup; configurable log level - #545
Merged
DonOmalVindula merged 4 commits intoSep 5, 2026
Conversation
The client provider handed every redirect to the Next.js app router, including the identity server's hosted sign-in, sign-up and logout URLs. The router can only render routes of this application, so for those it first requested the URL as a React Server Components payload, which the browser blocked with a CORS error, and only then fell back to a normal navigation. Sign-out therefore worked but logged "Failed to fetch RSC payload" and CORS errors every time. Route the redirects through a small navigateTo helper that uses window.location.assign for cross-origin URLs and the router for in-app ones.
|
Warning Review limit reachedNext included review available in 13 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (7)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…n the hidden trigger
FloatingFocusManager marks everything outside an open dialog aria-hidden. With
initialFocus={-1} the focus stayed on the element that opened the dialog, e.g.
the user dropdown trigger in a page header, so a focused element was hidden
from assistive technology and Chrome logged "Blocked aria-hidden on an element
because its descendant retained focus" whenever the profile popup opened.
Focus the dialog container itself on open. This keeps the previous behaviour of
not auto-focusing the first input.
DonOmalVindula
changed the title
…make the log level configurable - The embedded sign-in/sign-up flows open the identity provider in a popup named oauth_popup and read code/state from that window's URL themselves. The client provider also ran its OAuth callback handler in that popup, tried to exchange a code that belonged to the embedded flow, and logged "Authentication failed" on every social login even though the flow completed. - The server-side logger was hardcoded to error level, hiding warnings such as the SCIM2 profile fallback. ASGARDEO_LOG_LEVEL now selects the level.
DonOmalVindula
changed the title
pavinduLakshan
approved these changes
Sep 5, 2026
🦋 Changeset detectedThe changes in this PR will be included in the next version bump. Not sure what this means? Click here to learn what changesets are. |
pavinduLakshan
approved these changes
Sep 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Two console errors reported while testing the released 0.3.31 line in a Next.js app:
Changes
Next.js: cross-origin redirects
navigateTo(router, url): useswindow.location.assignwhenurlis cross-origin androuter.pushotherwise.AsgardeoProvider(OAuth callback redirect,signInUrl,afterSignInUrl,signUpUrl,afterSignUpUrl,afterSignOutUrl) through it.The app router can only render this application's routes. Given an external URL it first fetches it as an RSC payload, which the browser blocks (no CORS headers on the identity server's logout endpoint), and then falls back to a full navigation. The fallback is why sign-out still worked; the errors were the cost.
React: dialog focus
FloatingFocusManagermarks everything outside the dialogaria-hidden, butinitialFocus={-1}left focus on the trigger button inside the now-hidden page header. The dialog container now receives focus on open (initialFocus={context.refs.floating}plustabIndex={-1}). The first input is still not auto-focused.Next.js: spurious "Authentication failed" on social login
oauth_popupand readcode/statefrom that window themselves. The client provider also ran its OAuth callback handler inside that popup, tried to exchange a code belonging to the embedded flow, and logged "Authentication failed" although the login completed. The handler now skips that window.Next.js: configurable log level
error, which hid the warning that explains why a profile fell back to the ID token claims.ASGARDEO_LOG_LEVEL(debug|info|warn|error, defaulterror) now selects the level; documented in the README.One changeset covers both packages.
Testing
@asgardeo/nextjsand@asgardeo/reactunit tests pass.nexus2026tenant: sign in, sign out with zero console errors, user lands on the app signed out; after opening the profile popup the focused element is the dialog content (it was the dropdown trigger outside the dialog with 0.25.9).