How to resolve errors like "callbackParams of undefined" and "state mismatch"

[johnnynanjiang]

Hi folks (cc @panva @svvac @madarche @sawyerh)

Is that correct to assume that the same openIdClient instance should be handling both openIdClient.authorizationUrl() and openIdClient.callbackParams() for a particular authentication request.

As I found out, it could be wrong, that if the instance is different between these 2 calls, then "callbackParams of undefined" and "state mismatch" errors could happen, especially in a multi-instance environment.

[svvac]

As far as I know the library does not hold state regarding the authentication flow.

As long as you properly sync request state (e.g. nonce, state, code_challenge, etc.) between your instances, it should work provided that they share the same config.

[johnnynanjiang]

Thanks @svvac for the reply.

Actually I'm not sure if it is the case or not, but according to my own spike and debugging, I could reproduce the 2 errors using different openid client instance for the same callback request.

Also I had a question on stackoverflow, and some other folk confirmed my case.
https://stackoverflow.com/questions/68789837/node-openid-client-how-to-resolve-errors-like-callbackparams-of-undefined-and

Can @panva please confirm or clarify?

[panva]

I can do no such thing without error stacktraces and reproduction repository/steps.

[svvac]

The stated reason in your SO answer sounds wrong to me. You do not need to share an instance between the two steps to make PKCE work. You still need some state sharing mechanism for the checks to work, but this applies whether or not you end up using the same instance or not.

Here is a toy implementation that uses two different servers (ports) and single-use Client instances that use a shared encrypted cookie to sync state (code verifier + nonce).

[johnnynanjiang]

@svvac you are right, I think the problem is with the caller, in my case it is XeroClient, it doesn't initialise the openIdClient for callbacks properly.

I have raised a PR for them
XeroAPI/xero-node#545