state mismatch

[big8extreme]

hi,
I run into a state mismatch error, i read the previous issue but i dont understant what to do.
im using express with passport

state mismatch

Error: state mismatch
    at Client.authorizationCallback (C:\appl\tmi\node_modules\openid-client\lib\client.js:309:29)
    at OpenIDConnectStrategy.authenticate (C:\appl\tmi\node_modules\openid-client\lib\passport_strategy.js:137:27)
    at attempt (C:\appl\tmi\node_modules\passport\lib\middleware\authenticate.js:361:16)
    at authenticate (C:\appl\tmi\node_modules\passport\lib\middleware\authenticate.js:362:7)
    at Layer.handle [as handle_request] (C:\appl\tmi\node_modules\express\lib\router\layer.js:95:5)
    at next (C:\appl\tmi\node_modules\express\lib\router\route.js:137:13)
    at Route.dispatch (C:\appl\tmi\node_modules\express\lib\router\route.js:112:3)
    at Layer.handle [as handle_request] (C:\appl\tmi\node_modules\express\lib\router\layer.js:95:5)
    at C:\appl\tmi\node_modules\express\lib\router\index.js:281:22
    at Function.process_params (C:\appl\tmi\node_modules\express\lib\router\index.js:335:12)

i checked the cookie and its not secure:

app.use(session({ secret: 'foo', resave: false, saveUnitialized: true, cookie: { secure: false } }));

and the callback return 2 params: code and state.

i need help, please 😄

[panva]

I cannot see how i could possibly help when i know it's something to do with the way you have your sessions set up or cookies and i don't see your whole setup :)

[big8extreme]

thx for your reply

this my app.js

const express = require('express');
const path = require('path');
const favicon = require('serve-favicon');
const logger = require('morgan');
const request = require('request');
const fs = require('fs');
const cookieParser = require('cookie-parser');
const session = require('cookie-session');
const bodyParser = require('body-parser');
const index = require('./routes/index');
const auth = require('./routes/auth');
const passport = require('passport');
const Strategy = require('openid-client').Strategy;
const Issuer = require('openid-client').Issuer;
const app = express();
// view engine setup
app.set('views', path.join(__dirname, 'views'));
app.set('view engine', 'pug');

// uncomment after placing your favicon in /public
//app.use(favicon(path.join(__dirname, 'public', 'favicon.ico')));
app.use(logger('dev'));
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({extended: false}));
app.use(cookieParser());
app.use(session({ secret: 'foo', resave: false, saveUnitialized: true, cookie: { secure: false } }));

Issuer.discover('https://oidc')
    .then(idSrvIssuer => {
        const client = new idSrvIssuer.Client({
            client_id: 'client_id',
            client_secret: 'client'
        });

        const params = {
            redirect_uri: 'https:/url/auth/sso/callback',
            scope: 'openid profile'
        };

        passport.use('oidc', new Strategy({client, params}, (tokenset, userinfo, done) => {
            // **NEVER GET HERE**
            console.log(session);
            if (tokenset.claims.role !== 'role') {
                const err = new Error('Not Authorized');
                console.log(err);
                return done(null, false);
            }else {
                return done(null, userinfo);
            }
        }));
    })
    .catch(ex => {
        console.log(ex)
    });

passport.serializeUser(function (user, done) {
    done(null, user);
});

passport.deserializeUser(function (user, done) {
    done(null, user);
});

app.use(passport.initialize());
app.use(passport.session()); // persistent login sessions
app.use('/static', express.static(path.join(__dirname, '/public/static')));
app.get('/', function (req, res, next) {
    if (req.isAuthenticated()) {
        res.sendFile(path.resolve(__dirname, 'public/index.html'));
    } else {
        res.redirect('/auth/sso/login');
    }
});
app.use('/api/v1/', index);
app.use('/auth/sso/', auth);

// catch 404 and forward to error handler
app.use(function (req, res, next) {
    const err = new Error('Not Found');
    err.status = 404;
    next(err);
});

// error handler
app.use(function (err, req, res, next) {
    // set locals, only providing error in development
    res.locals.message = err.message;
    res.locals.error = req.app.get('env') === 'development' ? err : {};

    // render the error page
    res.status(err.status || 500);
    res.render('error');
});

module.exports = app;

and this is the router file auth.js

const express = require('express');
const router = express.Router();
const passport = require('passport');

router.get('/callback', passport.authenticate('oidc', { successRedirect: '/', failureRedirect: '/auth/sso/failure' }));

router.get('/failure', function (req, res) {
    res.status(403).send('login failed');
});

router.get('/login', passport.authenticate('oidc'));

module.exports = router;

[panva]

As i suspected, the problem is somewhere within your environment. The following gist for me works just fine and i get to the oidc claims with no issues whatsoever. What i find strange is your redirect uri. And your session cookie should be secure if you're using https...

And it's also entirely possible your OP is not sending the state back unmodified and then that's the actual problem, but that's why the assertion is in place.