Skip to content

[v2.14] Open the OAuth authorize URL on Windows without a shell - #664

Open
pmatseykanets wants to merge 1 commit into
rancher:v2.14from
pmatseykanets:fix-windows-oauth-browser-url-truncation-v2.14
Open

[v2.14] Open the OAuth authorize URL on Windows without a shell#664
pmatseykanets wants to merge 1 commit into
rancher:v2.14from
pmatseykanets:fix-windows-oauth-browser-url-truncation-v2.14

Conversation

@pmatseykanets

@pmatseykanets pmatseykanets commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Issue: rancher/rancher#56970

Backport of #657

On Windows, openBrowser launched the browser via `cmd /c start "" <url>`.
cmd.exe parses `&` as a command separator, so authorize URLs with multiple
query parameters (e.g. Azure AD's client_id, scope, response_type) were
truncated before reaching the browser, causing AADSTS900144 failures.

openBrowser now delegates OS-specific launching to a new osOpenURL function.
The Windows implementation uses the ShellExecute API, passing the URL as an
opaque argument with no command line built, so it can't be reinterpreted by
a shell. macOS and Linux keep using exec.Command with the URL as a single
argv element, unchanged in behavior. golang.org/x/sys moves from an indirect
to a direct dependency, matching the new osOpenURL import.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants