From: Justin Wind Date: Sat, 10 Jun 2023 18:45:28 +0000 (-0700) Subject: generate fresh state uuid instead of lifting from ctx, as requestId is migrated to... X-Git-Tag: v1.3.1~4 X-Git-Url: https://git.squeep.com/?a=commitdiff_plain;h=dcbdec0fcdf0b0241a155c89ae03f63ecba6d395;p=squeep-authentication-module generate fresh state uuid instead of lifting from ctx, as requestId is migrated to async local storage in later services --- diff --git a/lib/session-manager.js b/lib/session-manager.js index 9428203..6af1017 100644 --- a/lib/session-manager.js +++ b/lib/session-manager.js @@ -6,6 +6,7 @@ const { Communication: IndieAuthCommunication } = require('@squeep/indieauth-helper'); const { MysteryBox } = require('@squeep/mystery-box'); +const { randomUUID } = require('crypto'); const common = require('./common'); const Enum = require('./enum'); const Template = require('./template'); @@ -180,9 +181,10 @@ class SessionManager { if (authorizationEndpoint) { const pkce = await IndieAuthCommunication.generatePKCE(); + const state = randomUUID(); session = { authorizationEndpoint: authorizationEndpoint.href, - state: ctx.requestId, + state, codeVerifier: pkce.codeVerifier, me, redirect,