jaredhanson / passport-oauth2

OAuth 2.0 authentication strategy for Passport and Node.js.
https://www.passportjs.org/packages/passport-oauth2/?utm_source=github&utm_medium=referral&utm_campaign=passport-oauth2&utm_content=about
MIT License
607 stars 343 forks source link

sessionKey for SessionStateStore depends on OAuth hostname #94

Open joh-klein opened 7 years ago

joh-klein commented 7 years ago

I know, that's what the code says anyway. Couple of questions: Why? :) My Issue: since the key is session independent (by design) it is always generated by the last user, that is trying to log in. If the OAuth URL changes between users (which it does in my scenario) it is possible, that the key changes for a slow user (when another user tries to login before the first user is successfully logged in) and thus the state can't be validated.

Now, I know I can set the sessionKey to a fixed value, but I was wondering, why you are generating it from something, that can potentially change between users.

PS: All this insight was made possible by the PR #93 which finally explained all the different options! Thanks for that!