Google OAuth Redirect AuthStateMissing error

[gannonprudhomme]

We've been frequently getting the following error on the /complete/google-oauth2/ route:

"Internal Server Error: /complete/google-oauth2/
Traceback (most recent call last):
  File "/layers/google.python.pip/pip/lib/python3.7/site-packages/django/core/handlers/exception.py", line 34, in inner
    response = get_response(request)
  File "/layers/google.python.pip/pip/lib/python3.7/site-packages/django/core/handlers/base.py", line 115, in _get_response
    response = self.process_exception_by_middleware(e, request)
  File "/layers/google.python.pip/pip/lib/python3.7/site-packages/django/core/handlers/base.py", line 113, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/layers/google.python.pip/pip/lib/python3.7/site-packages/django/views/decorators/cache.py", line 44, in _wrapped_view_func
    response = view_func(request, *args, **kwargs)
  File "/layers/google.python.pip/pip/lib/python3.7/site-packages/django/views/decorators/csrf.py", line 54, in wrapped_view
    return view_func(*args, **kwargs)
  File "/layers/google.python.pip/pip/lib/python3.7/site-packages/social_django/utils.py", line 49, in wrapper
    return func(request, backend, *args, **kwargs)
  File "/layers/google.python.pip/pip/lib/python3.7/site-packages/social_django/views.py", line 33, in complete
    *args, **kwargs)
  File "/layers/google.python.pip/pip/lib/python3.7/site-packages/social_core/actions.py", line 45, in do_complete
    user = backend.complete(user=user, *args, **kwargs)
  File "/layers/google.python.pip/pip/lib/python3.7/site-packages/social_core/backends/base.py", line 40, in complete
    return self.auth_complete(*args, **kwargs)
  File "/layers/google.python.pip/pip/lib/python3.7/site-packages/social_core/utils.py", line 248, in wrapper
    return func(*args, **kwargs)
  File "/layers/google.python.pip/pip/lib/python3.7/site-packages/social_core/backends/oauth.py", line 375, in auth_complete
    state = self.validate_state()
  File "/layers/google.python.pip/pip/lib/python3.7/site-packages/social_core/backends/oauth.py", line 87, in validate_state
    raise AuthStateMissing(self, 'state')
social_core.exceptions.AuthStateMissing: Session value state missing." 

Easy way to query on GCP Logs Explorer: severity=(EMERGENCY OR ALERT OR CRITICAL OR ERROR) OR protoPayload.resource =~ "/complete/google-oauth2/.*"

[tonydattolo]

Are you using NextJS as well with this issue? It seems the server side session state that is passed to the Google call is not being persisted on the backend. Looking at social_core/backends/oauth.py the state is being set in the get_state_or_create function, however the redirect state variable isn't being updated. Not sure where that's supposed to happen can just print all the variables and see it happening