Prepare for v3.5.2.3

Due to Safari's aggressive caching updated jellyfin_credentials were not
used. They were overwritten with the old credentials instead. This fix
removes jellyfin_credentials first, then let's iframe load and create
new jellyfin_credentials with no access token. After this we update it
and login succeeds.

SSO-Auth/Api/SSOController.cs

@@ -91,6 +91,8 @@ public class SSOController : ControllerBase
                 RedirectUri = GetRequestBase(config.SchemeOverride) + $"/sso/OID/{(Request.Path.Value.Contains("/start/", StringComparison.InvariantCultureIgnoreCase) ? "redirect" : "r")}/" + provider,
                 Scope = string.Join(" ", scopes.Prepend("openid profile")),
             };
+            var oidEndpointUri = new Uri(config.OidEndpoint?.Trim());
+            options.Policy.Discovery.AdditionalEndpointBaseAddresses.Add(oidEndpointUri.GetLeftPart(UriPartial.Authority));
             options.Policy.Discovery.ValidateEndpoints = !config.DoNotValidateEndpoints; // For Google and other providers with different endpoints
             options.Policy.Discovery.RequireHttps = !config.DisableHttps;
             options.Policy.Discovery.ValidateIssuerName = !config.DoNotValidateIssuerName;
@@ -305,7 +307,9 @@ public class SSOController : ControllerBase
                 RedirectUri = redirectUri,
                 Scope = string.Join(" ", config.OidScopes.Prepend("openid profile")),
             };
-            options.Policy.Discovery.ValidateEndpoints = false; // For Google and other providers with different endpoints
+            var oidEndpointUri = new Uri(config.OidEndpoint?.Trim());
+            options.Policy.Discovery.AdditionalEndpointBaseAddresses.Add(oidEndpointUri.GetLeftPart(UriPartial.Authority));
+            options.Policy.Discovery.ValidateEndpoints = !config.DoNotValidateEndpoints; // For Google and other providers with different endpoints
             var oidcClient = new OidcClient(options);
             var state = await oidcClient.PrepareLoginAsync().ConfigureAwait(false);
             StateManager.Add(state.State, new TimedAuthorizeState(state, DateTime.Now));

SSO-Auth/WebResponse.cs

@@ -453,6 +453,9 @@ async function link(request) {
 }
 
 async function main() {
+    localStorage.removeItem('jellyfin_credentials');
+    document.getElementById('iframe-main').src = '" + baseUrl + @"/web/index.html';
+
     var data = '" + data + @"';
     while (localStorage.getItem(""_deviceId2"") == null ||
         localStorage.getItem(""jellyfin_credentials"") == null ||
@@ -501,6 +504,6 @@ document.addEventListener('DOMContentLoaded', function () {
 });
 
 // https://stackoverflow.com/a/25435165
-</script><iframe class='docs-texteventtarget-iframe' sandbox='allow-same-origin allow-forms allow-scripts' src='" + baseUrl + "/web/index.html' style='position: absolute;width:0;height:0;border:0;'></iframe></body></html>";
+</script><iframe id='iframe-main' class='docs-texteventtarget-iframe' sandbox='allow-same-origin allow-forms allow-scripts' src='' style='position: absolute;width:0;height:0;border:0;'></iframe></body></html>";
     }
 }

build.yaml

@@ -1,7 +1,7 @@
 name: "SSO Authentication"
 guid: "505ce9d1-d916-42fa-86ca-673ef241d7df"
 imageUrl: "https://raw.githubusercontent.com/9p4/jellyfin-plugin-sso/main/img/logo.png"
-version: "3.5.2.2"
+version: "3.5.2.3"
 targetAbi: "10.8.0.0"
 framework: "net6.0"
 owner: "9p4"
@@ -15,6 +15,7 @@ artifacts:
   - "IdentityModel.OidcClient.dll"
   - "IdentityModel.dll"
 changelog: |
+  3.5.2.3: Improve OpenID discovery policy security rules, fix iOS login bugs related to cache
   3.5.2.2: Fix linking page when using new paths
   3.5.2.1: Hotfix for SAML null checks
   3.5.2.0: Allow overriding the scheme used for generating URLs.