How can I add state to requestObject?

[optic-illusion]

Hi, I need to add the generated "state" value (from the request params) into the requestObject. How do I access the generated "state" value? Should I be setting it in client.requestObject()? Or is there a configuration to have "state" included in requestObject by default? Thanks.

[panva]

Just add the state you want to use for the request to client.requestObject(params) params.

[optic-illusion]

Isn't the "state" param generated in the authenticate() function in passport_strategy? Yet, the requestObject needs to be created prior to the authenticate() right?
I also tried generating the state and injecting it into the params and requestObject, but when the strategy is created, it deletes the state param and regenerates it in the authenticate(), thus, causing a mismatch of the state value between the one in the params and the one in the requestObject. Perhaps the Strategy should honor the "state" param passed in rather than blindly deleting/regenerating it?

[panva]

Ah... The Passport strategy. It is really intended for simple cases, if you have a more complex one, either don't use passport, or copy the strategy code to your own app and change whatever you need, you can see it's pretty thin.

[panva]

wait. you can pass both your request and state into authenticate() and both will be used.

passport.authenticate('oidc', { state: ..., request: ... })(req, res, next);

That way your state outside matches the inside and both the AS and the strategy callback have the same state value.