Getting the state parameter back

[daleif]

We can specify the state variable for example in oauth2.auth_url. But it is not obvious to be how we get it back.

Looking into the code behind oauth2.get_token_p we can see that the state variable is picked up when there is a incoming code request. And it is passed on to the POST call to the token_url. But the state is not included in the POST response (at least not in the tests I've made so far).

How exactly are we suppose to get the specific state value back again?

[tomascohen]

This is a bit specific to my project, but what I did is this, right before the call to get_token_p:

    # Determine if it is a callback request, or the initial
    my $is_callback = $c->param('error_description') || $c->param('error') || $c->param('code');

    my $state;

    if ($is_callback) {
        # callback, check CSRF token
        # FIXME: Optional?
        $state = $c->param('state');
        # check here
    }
    else {
        # initial request, generate CSRF token
        $state = Koha::Token->new->generate_csrf( { session_id => $c->req->cookie('CGISESSID')->value } );
    }

I based the $is_callback calculation on what I found in _get_token_p. Then, I do the usual

return $c->oauth2->get_token_p( $provider => { ( !$is_callback ? ( state => $state ) : () ), redirect_uri => ...

My feeling is we should add a couple function reference parameters to get_token_p:

• state_generator
• state_validator

that way it will be cleaner.