{{ message }}
Repository navigation
State value in callback query doesn't compared with session stored value #218
Description
At BaseOAuth20Provider.cs:
// Start with the Cross Site Request Forgery check.
var callbackState = queryStringParameters[StateKey];
if (string.IsNullOrEmpty(callbackState))
{
var errorMessage =
"The callback querystring doesn't include a state key/value parameter. We need one of these so we can to a CSRF check. Please check why the request url from the provider is missing the parameter: " +
StateKey + ". eg. &state=something...";
TraceSource.TraceError(errorMessage);
throw new AuthenticationException(errorMessage);
}
May be this line of code needed:
callbackState.Equals(state, StringComparison.OrdinalIgnoreCase)
Activity
[-]State value in callback query string doesn't compared with session stored value[/-][+]State value in callback query doesn't compared with session stored value[/+]PureKrome commentedon Jul 21, 2017
Hi @AlexanderSysoev - thanks for filing this issue.
can you please give some sample data where this fails the check, so I can understand the problem more.
plz?
AlexanderSysoev commentedon Jul 21, 2017
@PureKrome I've not tested yet, but I didn't find any comparison inside this region:
Cross Site Request Forgery checks -> state == state?PureKrome commentedon Jul 21, 2017
OK - so what you're saying is that I'm missing the state check in this part of the code?
(still trying to grok the problem)
AlexanderSysoev commentedon Jul 21, 2017
Exactly
PureKrome commentedon Jul 21, 2017
Ok - ta. gotcha! Phew :)
BTW - how did you figure this out?
AlexanderSysoev commentedon Jul 21, 2017
@PureKrome sorry for my bad communication skills)
Just viewing the code)