goauthentik / goauthentik/authentik

Remove empty state query parameters (at least) in OAuth2 provider's authorization redirects

Open
#14,422 3 comments 9 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 1h
Merged PRs (30d)
644

Description

**Is your feature request related to a problem? Please describe.**

My suggestion comes from a problem that arises using the [`openid-client`](https://github.com/panva/openid-client) library with NodeJS and Authentik OAuth2 Provider.

The problem, in detail, is that the provider when configured with the query response mode (default) will redirect to the provided URL adding two query parameters: `code` and an empty `state`, as expected ([reference](https://github.com/goauthentik/authentik/blob/be9ae7d4f7cb25b88593487d961b67513f6bdf1e/authentik/providers/oauth2/views/authorize.py#L559)), however, the library does interpret this as an empty string and has some difficulty accepting it as a valid value because it either expects no query parameter to be present or some non-empty string ([reference](https://github.com/panva/oauth4webapi/blob/da6c8b3ca34c02381fa4594b34316d2131ab4911/src/index.ts#L5360)).

Also worth noting, the library is not making any custom interpretation of empty query parameters it uses the methods defined by the native implementation of NodeJS ([reference](https://nodejs.org/docs/latest-v22.x/api/url.html#urlsearchparamsgetname))

**Describe the solution you'd like**

In my opinion, the sensible solution would be to entirely remove empty query parameters in case they have a null-ish value and not just an empty string value. For the given scenario the first case should apply and thus I'd expect no state parameter to be present.

**Describe alternatives you've considered**

I've looked into 2 different solutions:
- other response modes (POST and FRAGMENT) provided by Authentik also have the same behaviour and do not solve the issue;
- I can edit the URL to remove any empty query parameters before providing it to the library. Although this indeed solves the issue it doesn't feel right to blindly remove query parameters without the complete context.
- Enable the library option to disregard the state validation entirely, not advisable even though it does solve the issue

**Additional context**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.