IdentityModel.OidcClient icon indicating copy to clipboard operation
IdentityModel.OidcClient copied to clipboard

Confusing "state" query parameter causes bad request on Keycloak

Open RsZoli opened this issue 7 months ago • 0 comments

I'm having problem with the generated URL by the .NET client:

As you can see, the state query parameter is an object, and it is not even encoded:

https://127.0.0.1/realms/demo/protocol/openid-connect/auth?response_type=code&state={%22appInstanceId%22%3a%22%22%2c%22signinId%22%3a%22a4e0c2ad-b412-416c-b358-1314e232a797%22%2c%22state%22%3a%22t6kWLi5YApZ_RmSiTHXu1A%22}&code_challenge=Cvzy9NX8VjXtBjwtror3S7I67LEy2gclXNW9ZVmZ6EE&code_challenge_method=S256&client_id=account&scope=openid&redirect_uri=myapp%3a%2f%2fcallback

https://127.0.0.1/realms/demo/protocol/openid-connect/auth?response_type=code&state={"appInstanceId":"","signinId":"a4e0c2ad-b412-416c-b358-1314e232a797","state":"t6kWLi5YApZ_RmSiTHXu1A"}&code_challenge=Cvzy9NX8VjXtBjwtror3S7I67LEy2gclXNW9ZVmZ6EE&code_challenge_method=S256&client_id=account&scope=openid&redirect_uri=myapp://callback

Thic causes a bad request on my Keycloak, however if i manually switch out the value of the state parameter to the value of the "inner" state parameter, it just works:

https://127.0.0.1/realms/demo/protocol/openid-connect/auth?response_type=code&state=t6kWLi5YApZ_RmSiTHXu1A&code_challenge=Cvzy9NX8VjXtBjwtror3S7I67LEy2gclXNW9ZVmZ6EE&code_challenge_method=S256&client_id=account&scope=openid&redirect_uri=myapp%3a%2f%2fcallback

How can i achieve this in the .NET client? I do not need this "state object"!

Thank you!

RsZoli avatar Jul 10 '24 10:07 RsZoli