State Parameter

Good day,

I am using the OAuth class to link google account to our own user account. I would like to pass the user id to the oauth request. When it goes to the redirect URI, it will pass the user id back. Do you have an example of this?

Kind regards,

Jon

I am not sure what you mean.

Do you want to force authorizing on behalf of a specific user?

State parameter by default is designed in Auth 2.0 for passing the certain custom value to the provider's api and get exactly the same value as a response from round-trip api call. Which means if I define state='my-own-token-123' that value will go to the Api provider's server and come back as a response in the url from the provider for checking if those values are the same. So the question is - How to pass any custom value in "state" using your class?

Thanks

Did you find a solution for this?

Hello Sebas and James,

Sorry for the late response. The class sets the state to a specific value not only to set verify it is the same, but also to embed an expiry time to avoid security attacks.

I recommend that you avoid changing the state to an arbitrary value, or else the class will not be able to verify it with all the security requirements.

Anyway, if you tell me why you want to change the state parameter I may figure out a better solution. Can you explain?

Hi, I understand why having the state be handled internally can help avoid mistakes which might allow people to re-use responses.

However, from this article it seems state was indeed intended for 'state'.

thread-safe.com/2014/05/the-correct ...

Anyways, I work with an api project that does not use $_SESSION. Everything is stateless REST. So when a user logs in, I need to get them back to the page they're supposed to be at, and have some other state info. However, many oauth servers require preregistered redirect_uri and if you add parameters there, it fails.

So concretely the issue is that when the user arrives back at redirect_uri, I have no idea where this belongs, to forward him there. Furthermore, users are grouped into organizations, and I have no idea what organization to put the user into up first registration.

The workaround is to go ahead and start the session and store some state. But again, that was the point of 'state' originally. To pass some state. Now it's been coopted to serve as just kind of a 'nonce'