OAuth2 icon indicating copy to clipboard operation
OAuth2 copied to clipboard

Published 20 hours ago • verified publisher icon p2

client config: make state parameter optional

Open balland opened this issue 7 years ago • 5 comments
trafficstars

The state parameter is recommended but not mandatory so make this configurable in case the server does not support it. By default this is set to true in order to prevent cross-site request forgery.

balland avatar Sep 14 '18 12:09 balland

Do you know which servers don't support state? Not using state opens a gaping security hole and I would prefer if it has to be used.

p2 avatar Sep 14 '18 15:09 p2

In my case, this only happens when using QR codes and directly start the authentification process to the step of requesting the redirect URL. So in this case, there is no risk of cross-site request forgery. In the change I did, the state parameter is still checked if there is any.

balland avatar Sep 17 '18 10:09 balland

The risk is in the library being able to be used without state parameter, which I'm not a fan of. How exactly are you starting the flow? Maybe it makes sense to create a subclass for this use case.

p2 avatar Sep 17 '18 16:09 p2

Our scenario is when users log in with QR codes. The QR code encodes directly the redirect url so there is not state to check here. What would be the proper way to add such feature to the library?

balland avatar Oct 02 '18 07:10 balland

Subclass, take a look at e.g. OAuth2CodeGrantNoTokenType.

p2 avatar Oct 04 '18 05:10 p2