search

gardner / react-oauth2-pkce

React auth provider that works with AWS cognito PKCE🛡️🔒
49 stars 57 forks source link

Added support for state parameter and bumped version #45

Open Agrejus opened 2 years ago

Agrejus commented 2 years ago

Motivation:

I came across the need to send a value from the authorization request through to the authorization response. Outlined here, using the state parameter is the correct way to send values from the request to the response. This state parameter helps mitigate CSRF attacks

I changed the authorize and login functions to accept an optional state parameter.

Please note, I also bumped the package version as well. 2.0.7 -> 2.0.8

Agrejus commented 2 years ago

Closing due to time constraints. Going to use fork instead

christopherhein commented 2 years ago

What do we need to do to get this added @gardner ?

Agrejus commented 2 years ago

Reopening @christopherhein

Please review @gardner

hbusul commented 2 years ago

I'm not really good at react but I have some questions. I see that if you do not provide the state to the login function, it is not sent by default. Maybe the default behavior should be sending the state even when it is not specified, like a random string. Because if the authorization server does not implement PKCE, i guess state is one of the few ways to protect against XSS? And of course, in that case, i believe it should be also checked if the sent value is equal to the one server responded back.

And also, the authorization server that I use does not accept the request if it does not have state value in. I don't know if it is common but it might save some trouble to other people as well. Maybe, the state should always be sent and checked but if you like to use it for redirect, you should still be able to do it which I believe this implementation lets you do it.