# URL Redirection

Pass request parameters through Endorse redirects to identify authenticated devices.

Because we can take advantage of Soracom Endorse's Request Parameters option, we can append any data that would be useful for authorizing access to a network resource by simply appending that data to the HTTP token request:

```bash
curl https://endorse.soracom.io?username=sora
```

We can then combine the additional request parameters with Endorse's `redirect_url` behavior to create a login page that will authorize logins based on username and IMSI, rather than username and password.

## Components

### Endorse Options

To do this, we need to first enable the following Endorse options:

- **Items to include in token** - **IMSI** and **Request parameters**
- **Allow origin** - `https://myserver.example.com`
- **Authorized redirect URLs** - `https://myserver.example.com/login`

### Login Page

Next, we need to build a simple login page with a `username` field, which will POST an HTTP request to Endorse, including our desired `redirect_url` in the POST URL, and our `username` in the POST body:

- HTTP request URL: `https://endorse.soracom.io?redirect_url=https://myserver.example.com/login`
- HTTP request body: `username=sora`

### Issue Token and Redirect

When we submit our form while connected using a Soracom Air cellular connection, Endorse will issue a token and return an HTTP redirect response to `https://myserver.example.com/login`, with the issued token and `username` as the POST body.

Our server will receive the redirected requested, along with the following POST body content:

`soracom_endorse_token={ENDORSE-TOKEN}`

### Server Verification

We can then use a JWT library to decode the header and payload of the token. In order to authorize access:

1. Our server should download the public key indicated in the JWT header `kid` property.
2. Our server should then verify the token signature using the public key. If the signatures match, then:
3. Decode the payload of the token in order to extract the `username` (provided by the Request parameters option), and the `imsi` (provided by Endorse).
4. Our server should finally confirm that the `username` and `imsi` match existing records, and proceed with logging the user in.