AnswerDotAI / AnswerDotAI/fasthtml
[FEATURE] Support for state in login_link in Auth0 OAuth client
- Dominant language
- Jupyter Notebook
- Stars
- 7k
- Forks
- 319
- Avg merge
- 28m
- Merged PRs (30d)
- 3
Description
## Description
Currently, the `login_link` method in the `Auth0AppClient` (and possibly other OAuth clients) does not support passing a custom `state` parameter. The `state` parameter is important for maintaining state between the authentication request and callback, and is a recommended security best practice to prevent CSRF attacks.
## Expected Behavior
- The `login_link` method should accept an optional `state` argument.
- If provided, the `state` value should be included in the generated Auth0 authorization URL as a query parameter.
## Current Behavior
- The `state` parameter is not supported or ignored in the current implementation of `login_link` for `Auth0AppClient`.
## Example
```python
client = Auth0AppClient(...)
auth_url = client.login_link(req, state='my-custom-state')
# The generated URL should include: ...&state=my-custom-state
```
## Motivation
Supporting the `state` parameter is important for:
- Security (CSRF protection)
- Passing application-specific context through the OAuth flow
## Additional Context
- [Auth0 Docs: State Parameter](https://auth0.com/docs/secure/attack-protection/state-parameters)
- This feature would bring the Auth0 client in line with OAuth2 best practices and other client implementations.
Contributor guide
Research direction
Start at the Auth0AppClient.login_link implementation and inspect how it builds the Auth0 authorization URL. Add support for the optional state argument, then verify that a supplied value appears as the state query parameter and that existing calls remain valid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authentication
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100