slackapi / slackapi/bolt-js

installerOptions.stateStore.verifyStateParam not called when state parameter is empty

Open
#1,316 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

discussion semver:major
Dominant language
TypeScript
Stars
2.9k
Forks
445
Avg merge
1d 3h
Merged PRs (30d)
28

Description

Description

Error message: "Redirect url is missing the state query parameter. If this is intentional, see options for disabling default state verification."

To reproduce this error, you need to set stateVerification to true and try installing the app from the app page. (url wil be like
that ..&state=&....
installerOptions.stateStore.verifyStateParam not called when state parameter is empty

I think the check described below is not needed, because I can validate it myself in installerOptions.stateStore.verifyStateParam.

@slack/oauth/dist/index.js, line 379

if (this.stateVerification && !state) {
    throw new errors_1.MissingStateError('Redirect url is missing the state query parameter. If this is intentional, see options for disabling default state verification.')
}
What type of issue is this? (place an x in one of the [ ])
  • bug
  • enhancement (feature request)
  • question
  • documentation related
  • example code related
  • testing related
  • discussion
Requirements (place an x in each of the [ ])
  • I've read and understood the Contributing guidelines and have done my best effort to follow them.
  • I've read and agree to the Code of Conduct.
  • I've searched for any related issues and avoided creating a duplicate issue.

Bug Report

Filling out the following details about bugs will help us solve your issue sooner.

Reproducible in:

package version:
"@slack/bolt": "^3.9.0",
"@slack/oauth": "^2.4.0",
"@slack/web-api": "^6.6.0",
node version:

OS version(s):

Steps to reproduce:
  1. set stateVerification to true
  2. Try installing the app from the app page. (url wil be like
    that ..&state=&....
  3. after redirect your app will send error "Redirect url is missing the state query parameter. If this is intentional, see options for disabling default state verification."
Expected result:

Function verifyStateParam call

What you expected to happen
Function verifyStateParam call

Actual result:

error "Redirect url is missing the state query parameter. If this is intentional, see options for disabling default state verification."
What actually happened
@slack/oauth/dist/index.js, line 379

if (this.stateVerification && !state) {
    throw new errors_1.MissingStateError('Redirect url is missing the state query parameter. If this is intentional, see options for disabling default state verification.')
}
Attachments:

Logs, screenshots, screencast, sample project, funny gif, etc.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at @slack/oauth/dist/index.js line 379 and reproduce the issue with stateVerification enabled and an empty state query parameter. Trace the corresponding implementation and tests; done means verifyStateParam is called for this input instead of the MissingStateError being raised.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.