Skip to content

Oauth2.0 for X/Twitter : fails to limit the length of the state parameter. #2340

@sdocquir

Description

@sdocquir

Bug report

I confirm this is a bug with Supabase, not with my own application.
I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

During Oauth2.0 flow for X.com (recently added in version 2.184), the authorize url uses a state parameter that routinely goes over the max character length dictated by the official x.com documentation for their oauth2.0 implementation.
See X.com Docs, specifically the state param having a max char length of 500.

This results in an error on the redirect to x.com and breaks the oauth flow.

To Reproduce

Make the state param longer by passing in a long redirectUrl in the options parameter to supabase.signInWithAuth(), which should bring you over the state character limit of 500.

System information

Version : 2.185

Additional context

I'm not a huge fan of the 500 char limit from x.com, but I don't think we'll get very far if we just wait for them to bump that limit to something more reasonable like 1000. At the end of the day, the current implementation in this packege is not compliant with X.com's requirements.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions