Flask RemoteApp.authorize_access_token() includes state parameter in request

[lyschoening]

When following the typical authorization flow, the access token is requested from the authorization redirect URI. The RemoteApp implementation for Flask copies all request arguments of this callback and attaches them to the request for the authorization token.

@app.route('/authorize')
def authorize():
    token = oauth.google.authorize_access_token()
    # ...

authlib/authlib/flask/client/oauth.py

Line 190 in e01aafd

params = request.args.to_dict(flat=True)

The request arguments to the callback include "state", which does not need to be submitted with the request for the access token. Due to this, the Google API will respond with an error: "Parameter not allowed for this message type: state".

[lepture]

@lyschoening Did you try the Google connect on https://play.authlib.org/ ? Which works pretty well.

Besides, that state is recommended to be included in authorization request according to RFC:
https://tools.ietf.org/html/rfc6749#section-4.1.1

[lyschoening]

@lepture Is https://play.authlib.org/ a Flask app/sending the state parameter?

I'm authorizing through https://accounts.google.com/o/oauth2/token, not https://www.googleapis.com/oauth2/v4/token, which could explain why the behavior is different.

Google's documentation does not mention a state parameter
https://developers.google.com/identity/protocols/OAuth2WebServer#exchange-authorization-code and from reading around it seems this is known non-standard behavior in Google's API.

[lyschoening]

I should add that state isn't the only parameter being forwarded. Every parameter on the callback response is forwarded (authuser, session_state, prompt in this case).

[lepture]

@lyschoening Is there any reason that you have to use https://accounts.google.com/o/oauth2/token instead of https://www.googleapis.com/oauth2/v4/token

I'm ok to change the default behavior of request.args.to_dict(flat=True). But state will always be included, I don't think https://accounts.google.com/o/oauth2/token has done OAuth 2 right.

[lyschoening]

@lepture It's the URL in the configuration the Google Cloud console returns when you create an OAuth client for a web application.

[lepture]

@lyschoening I've cleaned up params in authorize_access_token.

Here is the endpoints that I found for Google: https://accounts.google.com/.well-known/openid-configuration