Setting "code" query parameter breaks auth0 state

[asktree]

If you're logged in to my site, and then add "?code=blah" to the href, auth0 now thinks I'm not logged in. I realize this has something to do with the oauth redirect flow, but the problem is that I need to use that query parameter (stripe uses it for their oauth flow: https://stripe.com/docs/connect/collect-then-transfer-guide).

Proposed change: if code param fails to change the auth0 state, auth0-react should fall back on whatever it would have the state be if that code were excluded (instead of just saying there's no user).

[adamjmcgrath]

Hi @asktree - am not sure how this library should work when there are multiple oauth providers on the same page, let me investigate and get back to you

[dutsik]

We have similar issue with LInkedIn authorization. when client provide us access to their linkedIn profile inside our app.

Can we stick auth0 code query parameter evaluation to auth0 callback URL explicitly somehow?

[dutsik]

Hi @asktree did you manage your situation somehow?

[adamjmcgrath]

Hi @dutsik @asktree

I have a branch (https://github.com/auth0/auth0-react/compare/skip-redirect-callback) where I've added the config option skipRedirectCallback, if true this will ignore the code/state parameters. You can apply this setting to be true on callback routes for other OAuth providers where you know the SDK doesn't need to handle the callback params. Or conversely, you can set it to true, unless you know the route to be the auth0 callback path, eg

<Auth0Provider
  domain={domain}
  clientId={clientId}
  redirectUri={`${window.location.origin}/auth0-callback`}
  skipRedirectCallback={window.location.pathname !== '/auth0-callback'}>

Can you try it out and let me know if it meets your needs?

[martinrojas]

@adamjmcgrath This previous merged address an issue is currently happening in my application. Is there a timeline for the next package update?

[adamjmcgrath]

Hey @martinrojas - I am waiting on an upstream dependency before I do another release - should be 1 week - 2 max

[adamjmcgrath]

Hey @martinrojas - this is released as 1.1.0

[martinrojas]

@adamjmcgrath Thank you

[dutsik]

@adamjmcgrath did you forget to include the skipRedirectCallback option to your merge? The LinkedIn Callback using both state and code query params. We need the option to expicilty skip the auth0 callback

[adamjmcgrath]

Hi @dutsik - the PR i merged was #107 which just mitigates the issue by requiring the state and code param to be in the url before handling the callback.

I didn't hear any feedback about the https://github.com/auth0/auth0-react/compare/skip-redirect-callback branch - so I didn't action it.

If you're looking for some more help around that, you can reopen this issue. Could you also share a minimal test case app, because I'd like to investigate some other solutions in addition to the skipRedirectCallback option

[svenadlung]

Hi @adamjmcgrath, in our case we want to add OAuth-flow from LinkedIn which also uses code and state in callback. I think #107 checks for this both params to decide its the Auth0-callback, which is not the case here :(

Adding skipRedirectCallback would be perfect in our case as well. Not sure how else to solve it. Could you maybe add it additionally and optionally?

[stevehobbsdev]

@svenadlung Auth0 supports using LinkedIn as a social connection, is there any reason you cannot use that over implementing it directly? As this library is specifically designed to work with Auth0, it's difficult for us to consider spending effort to support other options.

We just need to be careful about adding new properties like this, as they become much harder to remove later if they're not truly necessary. As @adamjmcgrath says, he has some other options he'd like to explore as well.

[svenadlung]

@stevehobbsdev Good idea! But we don't use social logins though. We need to connect a LinkedIn account as a team setting to publish articles to LinkedIn. It's not related to the login flow :(

[kcarra]

Was running into this issue when using stripes oauth work flow for connected accounts and the skipRedirectCallback option that @adamjmcgrath added solved this problem. Does it seem like this is going to be the solution in future releases as well?

[adamjmcgrath]

Hi @kcarra

Does it seem like this is going to be the solution in future releases as well?

Yep - that's the plan, do you have any feedback on it?

[kcarra]

@adamjmcgrath no specific feedback from me, it has solved my issues with the stripe oauth workflow so I'm very happy with your changes!

[johnnichev]

thx for this thread!