Skip to content

feat: add state parameter to OAuth strategies for enhanced security #1902

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 15, 2025

Conversation

Yukaii
Copy link
Member

@Yukaii Yukaii commented Mar 24, 2025

No description provided.

Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds a "state" parameter to various OAuth strategies in order to enhance security across authentication providers.

  • Add "state: true" configuration to OAuth strategies for Twitter, Google, Gitlab, GitHub, Facebook, Dropbox, and Bitbucket.
  • Update trailing commas for consistency in the configuration objects.

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file
File Description
lib/auth/twitter/index.js Added "state: true" to Twitter strategy (OAuth 1.0) configuration.
lib/auth/google/index.js Added "state: true" to Google strategy configuration.
lib/auth/gitlab/index.js Added "state: true" to Gitlab strategy configuration.
lib/auth/github/index.js Added "state: true" to GitHub strategy configuration.
lib/auth/facebook/index.js Added "state: true" to Facebook strategy configuration.
lib/auth/dropbox/index.js Added "state: true" to Dropbox strategy configuration.
lib/auth/bitbucket/index.js Added "state: true" to Bitbucket strategy configuration.
Comments suppressed due to low confidence (1)

lib/auth/twitter/index.js:16

  • TwitterStrategy is based on OAuth 1.0a, which typically does not support the state parameter. Please verify if including the state parameter for enhanced security is intended in this context.
state: true

@Yukaii Yukaii added this to the 2.6.0 milestone May 8, 2025
@Yukaii Yukaii merged commit 6dd3d92 into develop May 15, 2025
7 checks passed
@Yukaii Yukaii deleted the chore/dev-1880-enable-oauth-state branch May 15, 2025 06:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants