Open Agrejus opened 2 years ago
Closing due to time constraints. Going to use fork instead
What do we need to do to get this added @gardner ?
Reopening @christopherhein
Please review @gardner
I'm not really good at react but I have some questions. I see that if you do not provide the state
to the login function, it is not sent by default. Maybe the default behavior should be sending the state even when it is not specified, like a random string. Because if the authorization server does not implement PKCE, i guess state is one of the few ways to protect against XSS? And of course, in that case, i believe it should be also checked if the sent value is equal to the one server responded back.
And also, the authorization server that I use does not accept the request if it does not have state
value in. I don't know if it is common but it might save some trouble to other people as well. Maybe, the state should always be sent and checked but if you like to use it for redirect, you should still be able to do it which I believe this implementation lets you do it.
Motivation:
I came across the need to send a value from the authorization request through to the authorization response. Outlined here, using the state parameter is the correct way to send values from the request to the response. This
state
parameter helps mitigate CSRF attacksI changed the
authorize
andlogin
functions to accept an optional state parameter.Please note, I also bumped the package version as well.
2.0.7
->2.0.8