-
Notifications
You must be signed in to change notification settings - Fork 609
Description
Bug report
I confirm this is a bug with Supabase, not with my own application.
I confirm I have searched the Docs, GitHub Discussions, and Discord.
Describe the bug
During Oauth2.0 flow for X.com (recently added in version 2.184), the authorize url uses a state parameter that routinely goes over the max character length dictated by the official x.com documentation for their oauth2.0 implementation.
See X.com Docs, specifically the state param having a max char length of 500.
This results in an error on the redirect to x.com and breaks the oauth flow.
To Reproduce
Make the state param longer by passing in a long redirectUrl in the options parameter to supabase.signInWithAuth(), which should bring you over the state character limit of 500.
System information
Version : 2.185
Additional context
I'm not a huge fan of the 500 char limit from x.com, but I don't think we'll get very far if we just wait for them to bump that limit to something more reasonable like 1000. At the end of the day, the current implementation in this packege is not compliant with X.com's requirements.