fix(auth): add missing state parameter to OIDC authorization URL (#10614)

* fix(auth): add missing state parameter to OIDC authorization URL

The OIDC login route generates a state UUID and stores it in the
oidc_state cookie, but never includes it in the authorization URL.
This causes the OIDC callback to receive state=null, failing with
'oidc_error=missing_code' because the provider has no state to echo.

Add url.searchParams.set('state', state) after setting scope, so the
state parameter is sent to the OIDC provider and returned in the
callback for proper CSRF protection.

* test(auth): add regression coverage for OIDC login state parameter

Adds a TDD regression test proving the fix in this PR: the OIDC login
route now includes the state query parameter in the authorization
redirect URL, and it matches the oidc_state cookie value set on the
same response. Modeled on tests/unit/oidc-callback.test.ts.

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* fix(auth): use originEarly for OIDC err redirects (#10224)

* test(auth): verify OIDC err redirects use proxy origin (#10224)

---------

Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

src/app/api/auth/oidc/callback/route.ts

@@ -48,14 +48,14 @@ export async function GET(request: Request) {
   const originEarly = `${schemeEarly}://${hostEarly}`;
 
   if (!code || !returnedState) {
-    return NextResponse.redirect(new URL("/login?oidc_error=missing_code", reqUrlEarly));
+    return NextResponse.redirect(new URL("/login?oidc_error=missing_code", originEarly));
   }
 
   // Validate state from cookie (via seam so tests can capture)
   const cookieStore = await oidcCallbackInternals.getCookieStore();
   const storedState = cookieStore.get("oidc_state")?.value;
   if (!storedState || storedState !== returnedState) {
-    return NextResponse.redirect(new URL("/login?oidc_error=invalid_state", reqUrlEarly));
+    return NextResponse.redirect(new URL("/login?oidc_error=invalid_state", originEarly));
   }
 
   // Clear state cookie
@@ -80,7 +80,7 @@ export async function GET(request: Request) {
       : "/api/auth/oidc/callback";
 
   if (!enabled || !issuer || !clientId || !clientSecret) {
-    return NextResponse.redirect(new URL("/login?oidc_error=not_configured", reqUrlEarly));
+    return NextResponse.redirect(new URL("/login?oidc_error=not_configured", originEarly));
   }
 
   // Compute absolute redirect_uri matching what we sent
@@ -131,28 +131,28 @@ export async function GET(request: Request) {
       signal: AbortSignal.timeout(10000),
     });
   } catch {
-    return NextResponse.redirect(new URL("/login?oidc_error=token_exchange", reqUrlEarly));
+    return NextResponse.redirect(new URL("/login?oidc_error=token_exchange", originEarly));
   }
 
   if (!tokenResp.ok) {
-    return NextResponse.redirect(new URL("/login?oidc_error=token_exchange", reqUrlEarly));
+    return NextResponse.redirect(new URL("/login?oidc_error=token_exchange", originEarly));
   }
 
   let tokenData: unknown;
   try {
     tokenData = await tokenResp.json();
   } catch {
-    return NextResponse.redirect(new URL("/login?oidc_error=token_response", reqUrlEarly));
+    return NextResponse.redirect(new URL("/login?oidc_error=token_response", originEarly));
   }
 
   if (!tokenData || typeof tokenData !== "object") {
-    return NextResponse.redirect(new URL("/login?oidc_error=token_response", reqUrlEarly));
+    return NextResponse.redirect(new URL("/login?oidc_error=token_response", originEarly));
   }
 
   const td = tokenData as Record<string, unknown>;
   const idToken = typeof td.id_token === "string" ? td.id_token : undefined;
   if (!idToken) {
-    return NextResponse.redirect(new URL("/login?oidc_error=no_id_token", reqUrlEarly));
+    return NextResponse.redirect(new URL("/login?oidc_error=no_id_token", originEarly));
   }
 
   // Validate ID token
@@ -178,13 +178,11 @@ export async function GET(request: Request) {
         return email !== "" && v.toLowerCase() === email;
       });
       if (!ok) {
-        return NextResponse.redirect(
-          new URL("/login?oidc_error=subject_not_allowed", reqUrlEarly)
-        );
+        return NextResponse.redirect(new URL("/login?oidc_error=subject_not_allowed", originEarly));
       }
     }
   } catch {
-    return NextResponse.redirect(new URL("/login?oidc_error=id_token_invalid", reqUrlEarly));
+    return NextResponse.redirect(new URL("/login?oidc_error=id_token_invalid", originEarly));
   }
   // First successful OIDC login marks setupComplete (like password bootstrap).
   try {
@@ -194,9 +192,7 @@ export async function GET(request: Request) {
   }
   // Mint the exact same dashboard session JWT as password login
   if (!process.env.JWT_SECRET) {
-    return NextResponse.redirect(
-      new URL("/login?oidc_error=server_misconfigured", reqUrlEarly)
-    );
+    return NextResponse.redirect(new URL("/login?oidc_error=server_misconfigured", originEarly));
   }
 
   const forceSecureCookie = process.env.AUTH_COOKIE_SECURE === "true";

src/app/api/auth/oidc/login/route.ts

@@ -73,6 +73,7 @@ export async function GET(request: Request) {
   url.searchParams.set("client_id", clientId);
   url.searchParams.set("redirect_uri", redirectUri);
   url.searchParams.set("scope", scope);
+  url.searchParams.set("state", state);
   const isHttpsRequest = scheme === "https";
   const useSecureCookie = process.env.AUTH_COOKIE_SECURE === "true" || isHttpsRequest;
 

tests/unit/oidc-callback.test.ts

@@ -485,3 +485,24 @@ test("OIDC callback rejects missing JWT_SECRET at mint time (server_misconfigure
     globalThis.fetch = originalFetch;
   }
 });
+
+test("OIDC callback error redirect respects proxy headers (#10224)", async () => {
+  await setupFullOidcSettings();
+
+  // Omit code/state to force an immediate error redirect
+  // Use a bind-address style URL like when behind an internal proxy
+  const request = new Request("http://127.0.0.1:20128/api/auth/oidc/callback", {
+    headers: {
+      "x-forwarded-proto": "https",
+      host: "auth.pubg-sell.ir",
+    },
+  });
+
+  const response = await callbackRoute.GET(request);
+  assert.equal(response.status, 307);
+
+  const loc = response.headers.get("location") || "";
+  // Without the fix, this would be http://127.0.0.1:20128/login?oidc_error=missing_code
+  // With the fix, it correctly uses originEarly
+  assert.equal(loc, "https://auth.pubg-sell.ir/login?oidc_error=missing_code");
+});

tests/unit/oidc-login-state.test.ts

@@ -0,0 +1,120 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// NOTE: Dynamic imports below are used (with comment) solely because the modules read process.env at evaluation time.
+// The specifiers are literals. This is the established pattern in this repo's auth tests for env-controlled DB setup.
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-oidc-login-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.JWT_SECRET = "test-jwt-secret-for-oidc-login";
+
+// @ts-ignore - intentional for test harness timing (see note at top)
+const core = await import("../../src/lib/db/core.ts");
+// @ts-ignore - intentional for test harness timing
+const localDb = await import("../../src/lib/localDb.ts");
+// @ts-ignore - intentional for test harness timing
+const loginRoute = await import("../../src/app/api/auth/oidc/login/route.ts");
+
+async function resetStorage() {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  delete process.env.JWT_SECRET;
+});
+
+async function setupFullOidcSettings() {
+  await localDb.updateSettings({
+    requireLogin: true,
+    password: "",
+    oidcEnabled: true,
+    oidcIssuer: "https://idp.test",
+    oidcClientId: "client-oidc-test",
+    oidcClientSecret: "secret-oidc-test",
+    oidcRedirectPath: "/api/auth/oidc/callback",
+    oidcAllowedSubjects: [],
+  });
+}
+
+function extractCookieValue(setCookieHeader: string | null, name: string): string | undefined {
+  if (!setCookieHeader) return undefined;
+  const match = setCookieHeader
+    .split(";")
+    .map((part) => part.trim())
+    .find((part) => part.startsWith(`${name}=`));
+  return match ? decodeURIComponent(match.slice(name.length + 1)) : undefined;
+}
+
+test("OIDC login redirect includes a state parameter matching the oidc_state cookie", async () => {
+  await setupFullOidcSettings();
+
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (async (input: RequestInfo | URL) => {
+    const url = typeof input === "string" ? input : (input as URL).toString();
+    if (url.includes("/.well-known/openid-configuration")) {
+      // Force the deterministic fallback authEndpoint path (no live network dependency).
+      return new Response("not found", { status: 404 });
+    }
+    return new Response("not mocked", { status: 404 });
+  }) as unknown as typeof fetch;
+
+  try {
+    const response = await loginRoute.GET(
+      new Request("http://localhost/api/auth/oidc/login", {
+        headers: { "x-forwarded-proto": "http" },
+      })
+    );
+
+    assert.equal(response.status, 307);
+
+    const location = response.headers.get("location");
+    assert.ok(location, "redirect must include a Location header");
+
+    const redirectUrl = new URL(location as string);
+    const stateInUrl = redirectUrl.searchParams.get("state");
+    assert.ok(stateInUrl, "authorization URL must include a state query parameter");
+
+    const setCookieHeader = response.headers.get("set-cookie");
+    assert.ok(setCookieHeader, "response must set the oidc_state cookie");
+
+    const stateInCookie = extractCookieValue(setCookieHeader, "oidc_state");
+    assert.ok(stateInCookie, "oidc_state cookie must carry a value");
+
+    assert.equal(
+      stateInUrl,
+      stateInCookie,
+      "state parameter in the authorization URL must match the oidc_state cookie value"
+    );
+
+    // Basic cookie hygiene (mirrors the callback route's expectations)
+    assert.match(setCookieHeader as string, /HttpOnly/i);
+    assert.match(setCookieHeader as string, /SameSite=lax/i);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("OIDC login returns 400 without redirecting when OIDC is not configured", async () => {
+  await localDb.updateSettings({
+    requireLogin: true,
+    password: "",
+    oidcEnabled: false,
+  });
+
+  const response = await loginRoute.GET(new Request("http://localhost/api/auth/oidc/login"));
+
+  assert.equal(response.status, 400);
+  assert.equal(response.headers.get("location"), null);
+  assert.equal(response.headers.get("set-cookie"), null);
+});