rp.AuthURLHandler: stateFn could provide the current request as argument

[zitadel]

rp.AuthURLHandler: stateFn could provide the current request as argument

[livio-a]

Hey @oliverpool

In our case we already have a unique id created and stored in the database, which we then use for the state. The stateFn was therefore was a simple option to provide a slightly more open possibility.

But I see what you try to achieve and passing the http request to the function seems a sensible solution to get the current state of the users in you application (e.g. requested page) before they get redirected to the OP.

I am open to a PR with a concrete proposal 😃

As addition to your second comment from the OIDC spec:

state
RECOMMENDED. Opaque value used to maintain state between the request and the callback. Typically, Cross-Site Request Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the value of this parameter with a browser cookie.

If you pass a cookieHandler, the library will create an encrypted cookie to mitigate such attacks:
https://github.com/caos/oidc/blob/219ba4e038457f9db7877074f6760e53d559ddfc/example/client/app/app.go#L33-L38

[oliverpool]

In the end, I went using golang.org/x/oauth2.Config.AuthCodeURL(state) directly.

---

Actually I switched to https://github.com/coreos/go-oidc, because of the IDToken.Claims which allows to unmarshal the user claims directly

[oliverpool]

I just realized that state should be used to prevent csrf attacks: https://cs.opensource.google/go/x/oauth2/+/d3ed0bb2:oauth2.go;l=150

In this case, it might make sense to somehow generate and handle it automatically.

[fforootd]

Sorry that we could not help. But thanks for the request anyway.