Support overriding state variable

nginxinc · Feb 23, 2022 · 0354c2c · 0354c2c
1 parent db991ec
commit 0354c2c
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 2 deletions.
diff --git a/openid_connect.js b/openid_connect.js
@@ -259,7 +259,7 @@ function getAuthZArgs(r) {
 
         authZArgs += "&code_challenge_method=S256&code_challenge=" + pkce_code_challenge + "&state=" + r.variables.pkce_id;
     } else {
-        authZArgs += "&state=0";
+        authZArgs += "&state=" + r.variables.state;
     }
     return authZArgs;
 }
@@ -272,4 +272,4 @@ function idpClientAuth(r) {
     } else {
         return "code=" + r.variables.arg_code + "&client_secret=" + r.variables.oidc_client_secret;
     }   
-}
+}
diff --git a/openid_connect_configuration.conf b/openid_connect_configuration.conf
@@ -43,6 +43,12 @@ map $host $oidc_hmac_key {
     default "ChangeMe";
 }
 
+map $host $state {
+    # Unable to use this state if PKCE is enabled
+    default 0;
+}
+
+
 map $proto $oidc_cookie_flags {
     http  "Path=/; SameSite=lax;"; # For HTTP/plaintext testing
     https "Path=/; SameSite=lax; HttpOnly; Secure;"; # Production recommendation