Bruno Redirect URL

[saggdot]

@helloanoop Hi , do we have the Bruno callback/redirect url? Is there way to implement it ? Thanks !

[edbrannin]

I'm not Anoop, but I don't quite understand what you're asking for. Could you explain a bit more?

[saggdot]

Thanks for your response. Actually, I'm looking for callback url after authorization the user should land to a page such as https://www.getpostman.com/oauth2/callback in Postman.

[edbrannin]

It sounds like you're trying to do an oauth2 login flow -- I haven't automated one of those yet, but it sounds like:

1. You might be able to script something for this. Have you read the docs for scripting?
2. On the Roadmap, It looks like built-in Oauth2 support is on the roadmap sometime in v2:

[lizziemac]

Bumping this question now that OAuth 2.0 appears to be supported. What should the redirect URL be?

[pietrygamat]

Actually - it's whatever your application expects it to be - and some applications allow anything, while others expect very specific address or the authorizatin request may be rejected. You should check this with your application admin, or whoever granted your access, because this kind of misconfiguration may be hell to debug later.

[lizziemac]

Ah good to know! I think it's nice to know the default though, a lot of folks coming from postman (myself included) are used to the postman redirect default that requires little thinking 😆

[RagavMaddali]

bruno://auth : Is this redirect URL working with Azure entra ?

[charliehubbard]

@RagavMaddali I just tried adding bruno://auth to Azure entra and got an error: Must start with "HTTPS" or "http://localhost"

[pietrygamat]

Redirect URI (aka Callback URL) is the address that (in your example) Azure will redirect the browser after you provide correct login and password. The redirect request started by Azure will contain a sensitive authorization code, so it is important for all parties, that the redirect URI is trusted. In normal situations it points back to the endpoint at the website from which you are trying to access Azure data (e.g. https://my.app/auth) or is a custom deep link to some app installed on your device (custom protocols like bruno://, postman://, reddit.app:// are for that, but note bruno:// protocol is just a placeholder - Bruno app does not use it in any meaningfull way - perhaps this will change if #2650 is implemented).

Azure, Google, Facebook or other OAuth2 providers may have some rules in place. For example, Facebook will never allow http urls, @charliehubbard mentioned the Azure's limitations - others may have other restrictions. Some provides have no restrictions at all, and would allow any redirect URI whatsoever.

What is important from Bruno user perspective is that Bruno DOES NOT CARE what redirect URI is used - it can handle anything, because it never actually redirects to that URI - just snoops the secret from the address that the provider TRIED to redirect to. So your only concern is to know which URIs are allowed by your provider (Azure), and if you configure access on Azure side - make sure you are not allowing any malicious or untrusted urls, because that would put your app users (not Bruno users, the other users accessing https://my.app in browser) at risk of accidentally giving access to whoever owns that endpoints.

So if your application is already set up and running, just take a look what redirect URIs are already added in Azure console, and configure Bruno to use one of them - don't try to add anything new. Again, things may change with #2650, but as long as Bruno app is the one that owns the browser window showing login page, this stands.