How to use the state parameter in passport-okta-oauth?

Questions OAuth/OIDC
1

I am using passport-okta-oauth to implement Okta SSO in my application . I referred the documentation and came to know about the usage of the state parameter. However , when I pass state parameter in my request. I get the following error :

{ 'message': 'Unable to verify authorization request state'}

Here is the reference to my code:

app.get('/oauth/redirect/okta', function (req, res, next) {
        // Retriving the state value here 
        let stateString = JSON.parse(Buffer.from(req.query.state, 'base64').toString('ascii'));
        passport.authenticate('okta', { failureRedirect: `${config.oauthDomainUrl}/oauth/failure?provider=okta` }, function (err, user, info) {
            if (req.query.error != undefined) {
                res.redirect('/oauth/failure?provider=okta');
            } else {
                var profileId = user.id;

                /* Profile Id is sent along the URL to know that the user authentication is successful */
                let redirectUrl = `${config.redirectUrl}?pid=${profileId}&orgId=${stateString.orgId}&clientId=${stateString.clientId}`;
                res.redirect(redirectUrl)
            }

        })(req, res, next);
});

app.get('/oauth/okta', function (req, res, next) {
    let stateString = Buffer.from(JSON.stringify(req.query)).toString('base64')
        passport.authenticate('okta',{
            state: stateString // passing the state string here
        },function () {
            /* The request will be redirected to Okta for authentication, so this
                function will not be called. */
        })(req, res, next);
    }
})

In the three parameters in the successful redirect (err, user, info) . I get the following response

err : null

user : false

info : { 'message': 'Unable to verify authorization request state'}

Everything worked fine until I passed the state parameter.

2

I’m running into the exact same problem described here, can anyone offer an explanation or solution? I need to pass some state through to the callback so this is quite an issue.

To add some additional context, I can see that if I do not pass the state parameter, a randomly generated state value is attached to the request on the session property:

req.session:  Session {
  cookie: {
    path: '/',
    _expires: null,
    originalMaxAge: null,
    httpOnly: true,
    secure: false
  },
  '<myhost>.okta.com': { state: 'dzyMg6AO1xFxnwdn33WbnRKT' }
}

When I pass my custom state (which is just a string and is allowed as per the documentation) then that key/value pair is missing which causes the error from the oauth-library I am using (I am using passport-oauth2 but I also used passport-okta-oauth and experienced the same problem).

req.session:  Session {
  cookie: {
    path: '/',
    _expires: null,
    originalMaxAge: null,
    httpOnly: true,
    secure: false
  }
}
3

Hi,

I am having the similar issue and would like to know if anyone has had success with this?

4

For anyone looking - the solution for me was from here - Infinite redirect loop, "Invalid authorization request state." · Issue #89 · auth0/passport-auth0 · GitHub

1 Like