State parameter not preserved in authentication error response

[tutman96]

Describe the bug

When a client is requesting authentication with invalid scopes, the invalid_scope error is triggered and returned to the client in an authentication error response. However, if a state parameter is passed in the authentication request, is is not passed back in the response as described in https://openid.net/specs/openid-connect-core-1_0.html#AuthError.

This was actually found on accident when using oidc-client and requesting an invalid scope. The requests looked like as follows:

OAuth Authentication Request:

http://hydra:4444/oauth2/auth?
	client_id=client1&
	redirect_uri=http%3A%2F%2Flocalhost%3A9020%2Fcallback&
	response_type=code&
	scope=openid%20offline%20fake&
	state=2142791b8b11401ea4925e904a47e5d3&
	response_mode=query

Authentication Response:

http://localhost:9020/callback?
	error=invalid_scope&
	error_description=The+requested+scope+is+invalid%2C+unknown%2C+or+malformed&
	error_hint=The+OAuth+2.0+Client+is+not+allowed+to+request+scope+%22fake%22.&
	state=

Notice that the state parameter is empty, however the error is correct.

Environment

• Version: tested with v1.0.0 and v1.0.9
• Environment: Docker

I will poke around to see if I can pinpoint the issue, just wanted to open an issue to track it.

Thanks for the great service. Honestly this is the first issue I have come across, and it is a small one at that. With Hydra, we (who shall not be named) are processing over 20,000 authorization requests a week, serving close to 1,000 users.

[tutman96]

It seems to me like there is a slight error in fosite (https://github.com/ory/fosite/blob/master/authorize_request_handler.go#L265) where the state parameter doesn't even get read until all of the other parameters are validated. Does this seem like the cause?

[aeneasr]

Yes, looks like that could be the cause!

[aeneasr]

Would you be up for a PR in Fosite? :)

[tutman96]

Opening one now :)

[tutman96]

PR opened. Sorry for the crudity. This is my first PR with Go, so I might have missed some style points.

[aeneasr]

Awesome - thanks! By bumping ory/fosite in go.mod to v0.30.2 this patch will be ingested here!