Skip to content

Make the state parameter verification optional #127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Nov 29, 2022
Merged

Make the state parameter verification optional #127

merged 3 commits into from
Nov 29, 2022

Conversation

@skycocker
Copy link
Contributor

@skycocker skycocker commented Oct 27, 2022

Addresses #122.

@skycocker skycocker mentioned this pull request Oct 27, 2022
Closed
@skycocker skycocker changed the title (#122) Make the state parameter verification optional Make the state parameter verification optional Oct 27, 2022
@skycocker skycocker force-pushed the 122-ms-optional_state branch from 82ca2a2 to bbe06b6 Compare October 27, 2022 11:16
syakovyn
syakovyn reviewed Oct 27, 2022
View reviewed changes
lib/omniauth/strategies/openid_connect.rb Outdated
error = params['error_reason'] || params['error']
error_description = params['error_description'] || params['error_reason']
invalid_state = params['state'].to_s.empty? || params['state'] != stored_state
invalid_state = options.verify_state && (params['state'].to_s.empty? || params['state'] != stored_state)
Copy link

@syakovyn syakovyn Oct 27, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd not exclude state mismatch from the check. Only a case when there is no state stored and no state passed.
Maybe change it to:

(options.require_state && params['state'].to_s.empty?) || params['state'] != stored_state

and use require_state instead of verfiy_state

Copy link
Contributor Author

@skycocker skycocker Oct 27, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fair - made the changes.

@skycocker skycocker force-pushed the 122-ms-optional_state branch from bbe06b6 to 19b1c3d Compare October 27, 2022 14:58
@skycocker skycocker mentioned this pull request Nov 10, 2022
Merged
@stanhu
Copy link
Contributor

stanhu commented Nov 18, 2022

Can you rebase master?

@stanhu
Copy link
Contributor

stanhu commented Nov 21, 2022

There are also Rubocop failures in https://github.com/omniauth/omniauth_openid_connect/actions/runs/3338515447/jobs/5862634541.

@skycocker skycocker force-pushed the 122-ms-optional_state branch from 19b1c3d to de13bcf Compare November 21, 2022 15:47
@skycocker skycocker force-pushed the 122-ms-optional_state branch from de13bcf to 96de262 Compare November 21, 2022 15:50
@skycocker
Copy link
Contributor Author

skycocker commented Nov 21, 2022

Addressed.

@skycocker skycocker requested a review from syakovyn November 21, 2022 16:01
stanhu
stanhu reviewed Nov 21, 2022
View reviewed changes
CHANGELOG.md Outdated
@@ -1,3 +1,7 @@
# v0.4.1 (06.02.2022)
Copy link
Contributor

@stanhu stanhu Nov 21, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should probably create an UNRELEASED section, and update this after the official release has been cut.

stanhu
stanhu reviewed Nov 21, 2022
View reviewed changes
stanhu
stanhu reviewed Nov 21, 2022
View reviewed changes
@stanhu
Update release date to Unreleased
d122a4c
@stanhu
Drop unnecessary nonce parameters
239187c 
omniauth#132
refactored the test so that nonce is automatically generated.
@stanhu stanhu merged commit 445805b into omniauth:master Nov 29, 2022
@stanhu stanhu mentioned this pull request Jun 25, 2024
Closed
stanhu added a commit that referenced this pull request Jun 27, 2024
@stanhu
fix: make require_state skip verification of state
a8678e0 
In #127,
`require_state` was introduced because according to
https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.2.1,
`state` is recommended but not required:

```
state
    RECOMMENDED. Opaque value used to maintain state between the
    request and the callback. Typically, Cross-Site Request Forgery
    (CSRF, XSRF) mitigation is done by cryptographically binding the
    value of this parameter with a browser cookie.
```

During review, the `require_state` parameter was modified to verify
`state` as long as `stored_state` was present. However, `stored_state`
always holds at least a random value, so when `require_state` were
`false` and if an OpenID provider did not relay the `state` value,
authentication would halt with a "Invalid 'state' parameter" error.

This commit updates it so that if `require_state` is set to `false`,
the `state` parameter is never checked at all.
@stanhu stanhu mentioned this pull request Jun 27, 2024
Merged
stanhu added a commit that referenced this pull request Jun 27, 2024
@stanhu
fix: make require_state skip verification of state
328d87a 
In #127,
`require_state` was introduced because according to
https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.2.1,
`state` is recommended but not required:

```
state
    RECOMMENDED. Opaque value used to maintain state between the
    request and the callback. Typically, Cross-Site Request Forgery
    (CSRF, XSRF) mitigation is done by cryptographically binding the
    value of this parameter with a browser cookie.
```

During review, the `require_state` parameter was modified to verify
`state` as long as `stored_state` was present. However, `stored_state`
always holds at least a random value, so when `require_state` were
`false` and if an OpenID provider did not relay the `state` value,
authentication would halt with a "Invalid 'state' parameter" error.

This commit updates it so that if `require_state` is set to `false`,
the `state` parameter is never checked at all.
stanhu added a commit that referenced this pull request Jun 27, 2024
@stanhu
fix: make require_state skip verification of state
58a6d80 
In #127,
`require_state` was introduced because according to
https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.2.1,
`state` is recommended but not required:

```
state
    RECOMMENDED. Opaque value used to maintain state between the
    request and the callback. Typically, Cross-Site Request Forgery
    (CSRF, XSRF) mitigation is done by cryptographically binding the
    value of this parameter with a browser cookie.
```

During review, the `require_state` parameter was modified to verify
`state` as long as `stored_state` was present. However, `stored_state`
always holds at least a random value, so when `require_state` were
`false` and if an OpenID provider did not relay the `state` value,
authentication would halt with a "Invalid 'state' parameter" error.

This commit updates it so that if `require_state` is set to `false`,
the `state` parameter is never checked at all.
bufferoverflow pushed a commit that referenced this pull request Jun 28, 2024
@stanhu
fix: make require_state skip verification of state (#181)
8d1f8ed 
In #127,
`require_state` was introduced because according to
https://openid.net/specs/openid-connect-core-1_0.html#rfc.section.3.1.2.1,
`state` is recommended but not required:

```
state
    RECOMMENDED. Opaque value used to maintain state between the
    request and the callback. Typically, Cross-Site Request Forgery
    (CSRF, XSRF) mitigation is done by cryptographically binding the
    value of this parameter with a browser cookie.
```

During review, the `require_state` parameter was modified to verify
`state` as long as `stored_state` was present. However, `stored_state`
always holds at least a random value, so when `require_state` were
`false` and if an OpenID provider did not relay the `state` value,
authentication would halt with a "Invalid 'state' parameter" error.

This commit updates it so that if `require_state` is set to `false`,
the `state` parameter is never checked at all.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@stanhu stanhu stanhu left review comments

+1 more reviewer

@syakovyn syakovyn syakovyn approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@skycocker @stanhu @syakovyn