Passing dynamic state to Github Apps post install?

[APTy]

Select Topic Area

Question

Body

Similar to how OAuth apps can pass a state parameter to the callback, is there a way to do this with Github Apps?

I receive a webhook for installation.created, but I don't know how to associate that with a user in my application.

Put another way, is there a best practice for associating github events with applications?

Thanks!

Edit: Worth knowing I'm aware of the docs for Preserving an application state during installation but there's no clear way on how my backend should receive this state, and if it's entirely on the frontend, it's not trustworthy.

[alaabouayed]

@APTy Did you happen to resolve this using a server-side solution? Have you see the callback URL option that's available on the app settings page?

[bastienbeurier]

I'm also interested in solving this. When initiating a GitHub App auth flow from my app's frontend, it's hard to reconcile what internal account initiated the request with the webhook I get from GitHub (which has info only about the GitHub account).

The state parameter solves this with OAuth. I'm surprised that this was scrapped for this authorization system. The only two ways I see so far are cumbersome:

1. Using the post installation setup URL (very different from traditional OAuth)
2. Doing a prior OAuth flow to get the user's GitHub ID, then trigger the app installation flow, and reconcile using the GitHub ID in the webhook response

[naveen-jain]

@bastienbeurier did you get any solution for this ?

Post installation setup URL installation id can be changed by the user
How did you secure in the first approach ?

[bastienbeurier]

The state parameter is actually supported!

[danbernier]

I had this question too, and stumbled into an answer.

I was trying to pass a ?state param in the github URL for the app installation, and hoping that it would be appended to the URL I'd configured for my github app under "Post installation / Setup URL (optional)".

It Would. Not. Work. because I was sending the user to:

• https://github.com/apps/$github_app_slug?state=..., instead of
• https://github.com/apps/$github_app_slug/installations/new?state=..., which supports the ?state parameter.

What's confusing is that both URLs work for (afaict) all the other parts of the process: you get your app installed. But only the one ending in /installations/new supports the ?state parameter.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[M3tbe]

Actually the problem is still here, it would be great the state is kept after installation approval by and admin

[huksley]

I have the same problem - state param do not persist, and there is no way to authenticate request coming from Github redirect and not a malicious one.

So if you do some changes to the installation (or even use Back button to adjust installation a bit), it does redirect like to url like /api/github/callback?installation_id=99999999&setup&setup_action=update

I need state to check it is my request, without resorting to using a cookie.