Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

State parameter is missing in the Error response in the Form Post mode #12693

Closed
Tracked by #10408
ImalshaG opened this issue Oct 21, 2021 · 0 comments
Closed
Tracked by #10408
Assignees
Labels

Comments

@ImalshaG
Copy link
Contributor

Describe the issue:
According to the OIDCC Specification - 3.1.2.6 Section, if the authorization request includes the state parameter, the error response should contain that state value. But in the Form Post mode, the error response only contains the error and error_description parameters.

How to reproduce:

  1. Send a request to the authorization endpoint with response_mode=form_post, prompt=none and with a state value.
    For example:
    https://localhost.com:9443/oauth2/authorize?client_id=NBLGP4u0_1nMUfTkweIvvDISyjQa&redirect_uri=https://localhost.emobix.co.uk:8443/test/a/test/callback&scope=openid&state=WCd2wWyXvOOk9CteGQPaMCOwte6hQMGeKzqfLQtGiTPsaRt2MMv0SBBhnsuLpJfo1hT2aiPg5VjeI2qCT00jpX1Dg26XEAZiCxq32WqbzuR4PuSvhq9MukGC0KxJjH4r&nonce=vo46KcYXSv&response_type=code&response_mode=form_post&prompt=none

  2. A POST error response would be received with the response parameters in the form data as follows.

Screenshot 2021-10-21 at 14 51 58

Expected behavior:
Since a state value is included in the request, the response parameters should have a state parameter.

Environment information :

  • Product Version: IS 5.12.0-alpha6
  • OS: Mac
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
No open projects
Development

No branches or pull requests

2 participants