auth0 / express-openid-connect

An Express.js middleware to protect OpenID Connect web applications.
MIT License
465 stars 140 forks source link

Replace the "checks.state argument is missing" error message #627

Open natewaddoups opened 1 month ago

natewaddoups commented 1 month ago

Checklist

Describe the problem you'd like to have solved

There are a lot of requests for help with this error message, on multiple community sites.

The current error message probably made sense to whoever was writing the function that was invoked with a "checks" object that was missing a "state" property, but it's meaningless to the those of us who have to troubleshoot such errors, because we didn't call that function.

We didn't call any function with parameters that even looks remotely like it needs a "state" parameter.

In fact we even have a distraction - my only guess at the time was that this message was related to not setting the "state" property of callbackParams.tokenEndpointParams - because it's named "state" and it was passed to the last function that I called before getting this error... But I continued to get the same error when callbackParams.tokenEndpointParams.state was clearly NOT missing.

Describe the ideal solution

Change the error message to "checks.state is not present in the auth_verification cookie"

...since that's what people are told to investigate when they ask for help with this message.

Alternatives and current workarounds

  1. ask for help
  2. wait for a response
  3. someone posts a response

We could skip all of those steps and just put that clue right into the error message.

Additional context

I'd submit a PR to fix this, but I can't figure out where the phrase "argument is missing" is coming from.

I searched the repo, but only found results in test cases.