installerOptions.stateStore.verifyStateParam not called when state parameter is empty
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 445
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 28
Description
Description
Error message: "Redirect url is missing the state query parameter. If this is intentional, see options for disabling default state verification."
To reproduce this error, you need to set stateVerification to true and try installing the app from the app page. (url wil be like
that ..&state=&....
installerOptions.stateStore.verifyStateParam not called when state parameter is empty
I think the check described below is not needed, because I can validate it myself in installerOptions.stateStore.verifyStateParam.
@slack/oauth/dist/index.js, line 379
if (this.stateVerification && !state) {
throw new errors_1.MissingStateError('Redirect url is missing the state query parameter. If this is intentional, see options for disabling default state verification.')
}
What type of issue is this? (place an x in one of the [ ])
- bug
- enhancement (feature request)
- question
- documentation related
- example code related
- testing related
- discussion
Requirements (place an x in each of the [ ])
- I've read and understood the Contributing guidelines and have done my best effort to follow them.
- I've read and agree to the Code of Conduct.
- I've searched for any related issues and avoided creating a duplicate issue.
Bug Report
Filling out the following details about bugs will help us solve your issue sooner.
Reproducible in:
package version:
"@slack/bolt": "^3.9.0",
"@slack/oauth": "^2.4.0",
"@slack/web-api": "^6.6.0",
node version:
OS version(s):
Steps to reproduce:
- set stateVerification to true
- Try installing the app from the app page. (url wil be like
that ..&state=&.... - after redirect your app will send error "Redirect url is missing the state query parameter. If this is intentional, see options for disabling default state verification."
Expected result:
Function verifyStateParam call
What you expected to happen
Function verifyStateParam call
Actual result:
error "Redirect url is missing the state query parameter. If this is intentional, see options for disabling default state verification."
What actually happened
@slack/oauth/dist/index.js, line 379
if (this.stateVerification && !state) {
throw new errors_1.MissingStateError('Redirect url is missing the state query parameter. If this is intentional, see options for disabling default state verification.')
}
Attachments:
Logs, screenshots, screencast, sample project, funny gif, etc.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at @slack/oauth/dist/index.js line 379 and reproduce the issue with stateVerification enabled and an empty state query parameter. Trace the corresponding implementation and tests; done means verifyStateParam is called for this input instead of the MissingStateError being raised.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100