422 error on login with github

[maximepvrt]

No description provided.

[damisparks]

@maximepvrt, could you provide more information on this issue?
Ideally, screenshots, console logs and a way to reproduce the error.

[maximepvrt]

screen-20230722-220729.2.mp4

hello,

I encountered an issue while trying to connect to github using oauth through the brave mobile browser. whenever I attempt to log in, the browser redirects me to chrome for the authentication process. however, even after successful authentication, i receive a 422 error.

Steps to reproduce:

• Open Brave mobile browser on my Google Pixel 5 running Android 13.
  Navigate to the GitHub login page and click on the "Sign in with GitHub" button.
• Brave redirects to Chrome for authentication.
• Complete the authentication process on Chrome.
• After successful authentication, I encounter a 422 error.

Expected Behavior:
I expect to be able to log in to GitHub using OAuth directly through the Brave mobile browser without any errors or redirections to other browsers.

Additional Information:
Interestingly, even when I use the Chrome browser on my device, I still face an inconvenience. When I click on the "Sign in with GitHub" button, I am prompted to select the Chrome browser again for the authentication process, which seems redundant.

Best,

[atinux]

The errors comes from

nuxters/server/routes/oauth/github.ts

Lines 10 to 16 in 373768a

	if (state !== getCookie(event, 'state')) {
	throw createError({
	statusCode: 422,
	statusMessage: 'Potential cross-site request forgery detected.',
	})
	}

it seems that it cannot keep the cookie between the two apps 🤔

[maximepvrt]

Thank you for your response @atinux and for identifying the source of the issue.

Regarding the behavior of the mobile browser, I have noticed that when I click on the "Sign in with GitHub" button from both the Chrome and Brave browsers on my mobile device, I am prompted to choose an application for the authentication process.

Could you kindly shed some light on why this app selection prompt is appearing? Is there a specific reason for this behavior, and is there a way to configure it so that the authentication process can be streamlined without the need for manual app selection?

[maximepvrt]

https://github.com/nuxt/nuxters/blob/main/components/home/HomeCard.vue#L92

Why not use the "to" attribute of the UButton ? currently it generate a <a> inside a <button>

[atinux]

Nice idea @maximepvrt

Pushed a commit to update it, could you try again?

[maximepvrt]

Thank you @atinux. I tested, but …

In regard to the mobile browser behavior, I've come to realize that the prompt to select an application for the authentication process occurs due to the Android GitHub application intercepting all GitHub URLs. Subsequently, it suggests redirecting the externally generated GitHub link to a browser (without brave, my browser 😅)

[maximepvrt]

Github Android App issue https://github.com/orgs/community/discussions/51846