CODEWITHSUNDEEP
openid-connectopenid-client-js
jnj
jnj

Reputation: 775

node-openid-client, how to resolve errors like "callbackParams of undefined" and "state mismatch"

Regarding this library https://github.com/panva/node-openid-client

Is that correct to assume that the same openIdClient instance should be handling both openIdClient.authorizationUrl() and openIdClient.callbackParams() for a particular authentication request.

As I found out, it could be wrong, that if the instance is different between these 2 calls, then "callbackParams of undefined" and "state mismatch" errors could happen, especially in a multi-instance environment.

Thanks

Upvotes: 0

Views: 1609

Answers (2)

user9775882
user9775882

Reputation:

There is no requirement for the same Instance of the Client class to handle the init and callback phases.

Not being able to access Client.prototype.callbackParams due to client being undefined is an application level error.

The OP's problem in question is being handled in a package that includes openid-client here.

Upvotes: 1

Tore Nestenius
Tore Nestenius

Reputation: 19931

Yes, the client should be the same instance that handles the initial authentication request and that also retrieves the final tokens from the OICD provider.

Most of the security features like state and PKCE in OICD requires this to be true.

Upvotes: 1

Related Questions