Add the 'state' query parameter to the authenticate call about passport-facebook

[www-chique]

Is string state supports still?
My scenario is to pass some encoded JSON to /auth/facebook/callback with these extra parameters.
I need to avoid usage of session.

I had the very same situation.
However, I found a workaround

passport.authenticate("facebook", { scope: ["email"], state: "FOOBAR" }, async (err, user, info)=> {
     console.log(req.query.state); //Receives here "FOOBAR"
})(req, res);

And

passport.use(
	"facebook",
	new FacebookStrategy(
		{
			clientID: ...,
			clientSecret: ...,
			callbackURL: ...,
			profileFields: ...,
			passReqToCallback: true,
		},
		async (req: Request, accessToken: string, refreshToken: string, profile: any, done: any) => {
				console.log("state: " + req.query.state); //Works here too "FOOBAR"
		}
	)
);

So, instead of "FOOBAR", you can pass json string as well.

[wzup]

It is not documented, isn't it?
There is no any state word in a whole README.md.

1 . Why? Does it work whatsoever?
2. Where can I read ALL parameters that may be passed to strategy config? In one place, please. Now I have to search them all over the internet, one by one. passReqToCallback isn't mentioned in README.md as well. Now state. I'm curious how many good options are hidden? not documented properly.

[veeramarni]

any luck with custom state string?

[jaredhanson]

This is implemented in passport-oauth2 v1.0.0 (which passport-facebook v1.0.0 uses). To use it, enable state when creating your strategy:

var strategy = new FacebookStrategy({
  clientID: 'ABC123',
  clientSecret: 'secret',
  state: true
}, function() {...});

[jayarjo]

I receive:

OAuth 2.0 authentication requires session support when using state. Did you forget to use express-session middleware

It's and API host so I'm not using sessions, am I obligated to? Can I switch this requirement off @jaredhanson, since I'm validating state manually in a different way?

[jaredhanson]

For those who stumble upon this issue looking for how to handle state in OAuth 2.0, [email protected] adds support for automatically persisting application-level state. More information is available on the blog: Application State in OAuth 2.0

[jaredhanson]

In this commit to passport-oauth, I've added support for a state option, which can be used like so:

passport.authenticate('facebook', { state: 'foo' })

Thinking this through a bit more though, it seems like it might be a better option to implement a boolean version of the option:

passport.authenticate('facebook', { state: true })

In that case, Passport would generate a unique nonce before redirecting, save it to the session, and then verify it on the callback route. The string-only option doesn't seem entirely useful, since the verification is more easily done inside Passport.

What do you think?

[arius25]

I think the second option (nonce generated and verified by Passport) is the better solution.

Thanks for getting to it so quickly!

On Thursday, June 7, 2012 at 7:44 PM, Jared Hanson wrote:

In this commit to passport-oauth, I've added support for a state option, which can be used like so:

passport.authenticate('facebook', { state: 'foo' })

Thinking this through a bit more though, it seems like it might be a better option to implement a boolean version of the option:

passport.authenticate('facebook', { state: true })

In that case, Passport would generate a unique nonce before redirecting, save it to the session, and then verify it on the callback route. The string-only option doesn't seem entirely useful, since the verification is more easily done inside Passport.

What do you think?

---

Reply to this email directly or view it on GitHub:
#14 (comment)

[jaredhanson]

Agreed. I'll get this option implemented in the next couple of days.

[koteisaev]

Is string state supports still?
My scenario is to pass some encoded JSON to /auth/facebook/callback with these extra parameters.
I need to avoid usage of session.

[CLClark]

Passing "state: true" causes the Strategy object, upon instantiation, to write itself a "_stateStore" property with the value coming from ('passport-oauth2/state/session').SessionStore. Look up that module to see how the "state" field is handled... There does not appear to be a way to modify the state constructor without editing the SessionStore code. SessionStore is referred to as SessionStateStore in the passport-oauth2 constructor (from which passport-facebook strategy inherits).