search

panva / openid-client

OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
MIT License
1.83k stars 392 forks source link

Multiple authenticate requests from the same session causes state mismatch #639

Closed mrviniciux closed 11 months ago

mrviniciux commented 11 months ago

Describe the bug

Opening authentication in two different tabs result on state mismatch causing some libraries that use node-openid-client to throw an error to the user.

To Reproduce

Same steps as described here: https://github.com/panva/node-openid-client/issues/154

Expected behaviour A common user can easily open multiple tabs of an application and choose a random one after to login. But instead of having a successful login, an error is returned.

Environment:

Additional context

This issue is also related on next-auth projects:

https://github.com/nextauthjs/next-auth/issues/7894

In the issue above I posted some logs from next-auth.

Something similar also happened here: https://github.com/nextauthjs/next-auth/issues/3022

panva commented 11 months ago

Unsurprisingly, just like in the aforementioned #154, there's nothing much to do. The passport strategy is meant to remain simple, not dealing with edge cases.

As far as next-auth, or other pieces of work that utilize openid-client, they can orchestrate the state v session management however complex they can afford since the core library is not responsible for maintaining the user-agent state and its state in any way.