search

zorn-v / nextcloud-social-login

GNU Affero General Public License v3.0
198 stars 137 forks source link

redirect on The authorization state is either invalid or already consumed? #450

Open PatrickTOToole opened 5 months ago

PatrickTOToole commented 5 months ago

I have noticed on occasion with my auth provider that if a login takes too long it will get a message along the lines of The authorization state is either invalid or already consumed. I was wondering if there was anyway to include a redirect off of this page back to the login url.

zorn-v commented 5 months ago

Are you sure that problem in "login takes too long" ? In other cases it just "I did not configured routes on my kubernetes/modern_container_orchistrator" and just figure out your routes

PatrickTOToole commented 5 months ago

I'm not sure I understand the routes you are referring to. The only reproducible instance of this issue is when our user takes too long to sign in. I'm assuming the error happens because some state token expires. The question was how would you configure the redirect on the screen with the error mentioned as from my understanding it is a social login screen.

PatrickTOToole commented 5 months ago

I'm realizing a redirect from this page might not make sense. But if you could clarify the source of the error, is it something that comes from nextcloud or social login? Because it seems all of the errors we are seeing are displayed on the same page that is redirected from on a successful login

zorn-v commented 5 months ago

I'm assuming the error happens because some state token expires

I doubt about this. There is no expiration set on state, just ordinal php session wrapped by nextcloud (encryption etc.) Is your provider redirect with POST http method ? In that case browser may do not pass cookies.

botsarenthuman commented 3 months ago

I've seen an issue where, immediately after login and for a while, I can see the access token in the PHP session using (\OC::$server->getSession()

But if I come back 8 hours later, say, I can still pull the session data, but the access token is gone. Strangest thing.

botsarenthuman commented 3 months ago

LOL answered here https://github.com/nextcloud/server/issues/2081#issuecomment-322240642

I guess it is initially in the session, but then never gets saved to the cookie. So I need to save this off to the DB somehow.