Reza Rezaei d6242b7267 fix(auth): add missing state parameter to OIDC authorization URL (#10614) ...

* fix(auth): add missing state parameter to OIDC authorization URL

The OIDC login route generates a state UUID and stores it in the
oidc_state cookie, but never includes it in the authorization URL.
This causes the OIDC callback to receive state=null, failing with
'oidc_error=missing_code' because the provider has no state to echo.

Add url.searchParams.set('state', state) after setting scope, so the
state parameter is sent to the OIDC provider and returned in the
callback for proper CSRF protection.

* test(auth): add regression coverage for OIDC login state parameter

Adds a TDD regression test proving the fix in this PR: the OIDC login
route now includes the state query parameter in the authorization
redirect URL, and it matches the oidc_state cookie value set on the
same response. Modeled on tests/unit/oidc-callback.test.ts.

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

* fix(auth): use originEarly for OIDC err redirects (#10224)

* test(auth): verify OIDC err redirects use proxy origin (#10224)

---------

Co-authored-by: openhands <openhands@all-hands.dev>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

2026-08-18 10:53:18 -03:00

17 KiB

Raw Blame History

View Raw