angular-oauth2-oidc - Not passing 'State' and 'Scope'

Question

There is a requirement from the identity server of not to pass 'state' and 'scope' in the URL.

The request is in following format

URL?app=xxx&response_type=code&client_id=yyy&state=zzz&redirect_uri=aaa&scope=openid%20id%20offline_access**

Angular code loads the Auth Config as follows:

export const authConfigDefaults: AuthConfig = Object.freeze({
  oidc: false,
  responseType: 'code',
  scope: 'openid id offline_access',
  strictDiscoveryDocumentValidation: false,
  redirectUri: redirectURL,
  silentRefreshTimeout: HALF_HOUR,
  fallbackAccessTokenExpirationTimeInSec: HALF_HOUR,
  useSilentRefresh: true
});

'state' is passed in the URL even if I try to set 'state' = '' in the above block.

How to avoid state and scope in the URL which is passed to identity server?

state is indeed optional for the client the pass, but it's required for the server to support. Sounds like both your server and client are buggy. — Evert
– Evert, Commented Sep 6, 2022 at 9:36

Tore Nestenius · Accepted Answer · 2023-12-13 09:33:47Z

0

You must pass scope and state as parameters to IdentityServer, that is how OpenID Connect works...

why do you not want to pass it?

I recently blogged about the state and nonce parameter here:

Demystifying OpenID Connect’s State and Nonce Parameters in ASP.NET Core

edited Dec 13, 2023 at 9:33

answered Sep 6, 2022 at 9:21

Tore Nestenius

20.4k5 gold badges36 silver badges48 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Evert Over a year ago

state is optional

Tore Nestenius Over a year ago

Yes, state might be optional but it is recommended security best practice to keep , together with PKCE

Collectives™ on Stack Overflow

angular-oauth2-oidc - Not passing 'State' and 'Scope'

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related