Description
Checklist
- The issue can be reproduced in the auth0_flutter sample app (or N/A).
- I have looked into the Readme, Examples, and FAQ and have not found a suitable solution or answer.
- I have looked into the API documentation and have not found a suitable solution or answer.
- I have searched the issues and have not found a suitable solution or answer.
- I have searched the Auth0 Community forums and have not found a suitable solution or answer.
- I agree to the terms within the Auth0 Code of Conduct.
Description
When implementing a login with redirect flow for Flutter Web, I initially got it working as expected, without adding any extra state for redirects. However, when I needed to implement a redirect after login, I had to look around on how to do that.
I had been referred to the following documentation, by a colleague of mine:
https://auth0.com/docs/secure/attack-protection/state-parameters
So I started implementing the workflow as described in that document.
However, the document mentions a state
query parameter, without disclosing that Auth0 itself uses a state
query parameter in the redirect URL, for validation purposes in the Auth0 SDK.
After some searching, I did find out that there is an appState
parameter for the redirect login options.
See the answer at https://community.auth0.com/t/how-to-preserve-client-state-after-loginwithredirect/95963/6
Then I did some digging and found that this parameter is defined in the SDK as stated in the comment above
https://github.com/auth0/auth0-spa-js/blob/f2e566849efa398ca599daf9ebdfbbd62fcb1894/src/global.ts#L298
However, the Flutter plugin lacks this field in its implementation.
Reproduction
- flutter create auth0_sample --platforms=web
- flutter pub add auth0_flutter
- Implement the standard login functionality, for example with
http://localhost:3000
as callback url's for login / logout - Try adding the
appState
to the arguments ofloginWithRedirect()
, so that this state is returned back in the redirect url query parameters (albeit encoded) - Observe that there is no way to add the app state. Putting the app state in the
parameters
map does not work either
Additional context
No response
auth0_flutter version
1.7.2
Flutter version
3.24.3
Platform
Web
Platform version(s)
Google Chrome 131.0.6778.70