Don't include state in OAuth 2 exchange flow (#3034)

* Don't include state in OAuth 2 exchange flow if not specified
* Remove state entirely
This commit is contained in:
Oleg Vaskevich 2024-09-06 02:48:31 -07:00 committed by GitHub
parent c85d7b0c77
commit 5d7f44fc61
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -23,14 +23,13 @@ const resolveOAuth2AuthorizationCodeAccessToken = async (request, collectionUid)
let requestCopy = cloneDeep(request);
const { authorizationCode } = await getOAuth2AuthorizationCode(requestCopy, codeChallenge, collectionUid);
const oAuth = get(requestCopy, 'oauth2', {});
const { clientId, clientSecret, callbackUrl, scope, state, pkce } = oAuth;
const { clientId, clientSecret, callbackUrl, scope, pkce } = oAuth;
const data = {
grant_type: 'authorization_code',
code: authorizationCode,
redirect_uri: callbackUrl,
client_id: clientId,
client_secret: clientSecret,
state: state
client_secret: clientSecret
};
if (pkce) {
data['code_verifier'] = codeVerifier;