Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

'Nonce does not match' error when state data contains '=' encoded as %3D #377

Closed
BLevinger opened this issue Mar 6, 2017 · 3 comments
Closed
Labels
bug This points to a verified bug in the code
Milestone

Comments

@BLevinger
Copy link

BLevinger commented Mar 6, 2017

This issue occurs when btoa appends an '=' to the stringfy data object for base64 encoding. The state data then contains a %3D encoded character after it round trips from IDP login which causes TransactionManager to attempt to locate the transaction as 'ASDF%3D' instead of 'ASDF='

	    this.auth0.authorize({
			connection: authProviders.google,
			redirectUri: document.location.protocol + "//" + document.location.host + "/register",
			state: 'ASDF='
		})
}

Issue can be resolved by adding the following on line 51 of transaction-manager.js

transaction = transaction.replace(/%3D/ig, '=')

Occurs in chrome v56

@BLevinger
Copy link
Author

BLevinger commented Mar 6, 2017

I've updated my own code to strip the padding character. Not sure this should be fixed in auth0 as = should not be passed in the first place but I am seeing btoa include it.

@hzalaz
Copy link
Member

hzalaz commented Mar 6, 2017

We should handle the url decoding since the state comparison is done by auth0.js.

@hzalaz hzalaz added bug This points to a verified bug in the code P3: Important labels Mar 8, 2017
@hzalaz
Copy link
Member

hzalaz commented Mar 10, 2017

Closed by #382

@hzalaz hzalaz closed this as completed Mar 10, 2017
@hzalaz hzalaz modified the milestones: v8-Next, v8.4.0 Mar 10, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This points to a verified bug in the code
Projects
None yet
Development

No branches or pull requests

2 participants