- Issue created by @smokris
- Issue was unassigned.
- Status changed to Needs review
about 1 year ago 2:30pm 4 November 2023
Some providers, such as "Sign in with Apple", perform a POST request to the authorization callback / redirect URI and provide the state parameter in the POST body.
However, Social Auth's OAuth2ControllerBase::processCallback() currently assumes the state parameter is provided as a query argument, resulting in authorization failing and Social Auth outputting the message Login failed. Invalid OAuth2 state..
Instead of checking for state in Symfony\Component\HttpFoundation\Request::query (which provides only the query parameters), use Symfony\Component\HttpFoundation\Request::get (which checks both query parameters and POST body parameters).
Review attached patch.
n/a
n/a
n/a
Needs review
4.1
Code