You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Using Typescript, showSignIn signature defines RenderResult as promised return type, which, in case of succeeded OIdC login, resolves to RenderResultSuccessOIDC that has a state field.
That state field remains always undefined. From the client app's point of view, as there is no redirection, checking the state matching can appear not very valuable, except perhaps for consistency.
But what is more critical occurs in case of redirection, when another identity provider has been chosen by the user (for example through a "Sign-in with Google" button configured in widget's idps property). The value of the state field received by the redirect callback does not match the given one through RenderOptions argument:
extract file showSignInTest.html from archive and configure needed constants in the script tag
allow the defined redirect url in your Okta application
configure a secondary identity provider for your Okta application
publish the file with your preferred web server (HTTPS protocol needed)
Displaying the file in a browser you will get:
an alert "Undefined state" if your Okta user is already logged in.
an alert like "oyPlr5bW4adJJl5aLAuOk5KavLvgoLVf3Obct7TlMiONx0c6AQLPHaj8FMyD9rvP <> myStateValueHash" after successful login through secondary identity provider.
@jaredperreault-okta Your understanding is correct, yes, although, imho, these two different behaviors have the same origin.
Regarding the second case, involving a redirect, I am not sure about the "does not match the external IDP's state", and to be honest, I think that the widget should be in charge of checking the match of its own state value returned by the secondary IDP.
What I need to check is the match of the state value I passed in the showSignIn options. And for now, the returned value by the widget does not match, which could be the result of a CSRF attack and therefore should invalidate the login process ...
Describe the bug
Using Typescript,
showSignIn
signature definesRenderResult
as promised return type, which, in case of succeeded OIdC login, resolves toRenderResultSuccessOIDC
that has astate
field.That
state
field remains alwaysundefined
. From the client app's point of view, as there is no redirection, checking thestate
matching can appear not very valuable, except perhaps for consistency.But what is more critical occurs in case of redirection, when another identity provider has been chosen by the user (for example through a "Sign-in with Google" button configured in widget's
idps
property). The value of thestate
field received by the redirect callback does not match the given one throughRenderOptions
argument:Reproduction Steps
Using the attached file:
Displaying the file in a browser you will get:
showSignInTest.zip
SDK Versions
System:
Binaries:
Browsers: (in preference order)
npmPackages:
Remark: I do not use IE anymore ... ;-)
Additional Information
No response
The text was updated successfully, but these errors were encountered: