Yes, I opened issue on github.
Hi, I wonder, how I can check state in backend. As I can see there is method: signin(serverUrl, signinPath), with send code and state to backend, but when I call this I dont have state on backend. I wonder, why this method send state. As I understand, to protect against csrf attack, I should first call endpoint on backend, generate state, save in session, and return cookie with state, and next call to backend for code exchange should contain this state. But I wonder, why that method send state. Maybe I dont understand this flow?
This part of my frontend code: ```import SDK from "casdoor-js-sdk";
const sdk = new SDK({
serverUrl: "https://casdoor-server",
clientId: "id",
appName: "app",
organizationName: "organization",
redirectPath: "/auth",
signinPath: "/api/signin",
});
if (window.location.pathname === "/auth") {
await sdk.signin("http://localhost:8080");
}
window.location.href = sdk.getSigninUrl();and backend:from bottle import request, Bottle
from api.utils.cors import cors_enabled
def setup_auth_routes(app: Bottle):
@app.route('/api/signin', ['POST', 'OPTIONS'])
@cors_enabled
def auth_callback():
code = request.query.get('code')
state = request.query.get('state') ```
This part of my frontend code: ```import SDK from "casdoor-js-sdk";
const sdk = new SDK({
serverUrl: "https://casdoor-server",
clientId: "id",
appName: "app",
organizationName: "organization",
redirectPath: "/auth",
signinPath: "/api/signin",
});
if (window.location.pathname === "/auth") {
await sdk.signin("http://localhost:8080");
}
window.location.href = sdk.getSigninUrl();and backend:from bottle import request, Bottle
from api.utils.cors import cors_enabled
def setup_auth_routes(app: Bottle):
@app.route('/api/signin', ['POST', 'OPTIONS'])
@cors_enabled
def auth_callback():
code = request.query.get('code')
state = request.query.get('state') ```
I can get state param on backend, but how can I validate it? As I understand, I should have this state before call /api/signin in frontend.
I wonder, how I can check state in backend. As I can see there is method: signin(serverUrl, signinPath), with send code and state to backend, but when I call this I dont have state on backend. I wonder, why this method send state. As I understand, to protect against csrf attack, I should first call endpoint on backend, generate state, save in session, and return cookie with state, and next call to backend for code exchange should contain this state. But I wonder, why that method send state. Maybe I dont understand this flow?
I saw, that method from this sdk: https://github.com/casdoor/casdoor-java-sdk/blob/master/src/main/java/org/casbin/casdoor/service/AuthService.java, getOAuthToken take parametr state, but not use it anymore.
My doubts stem from the fact that the signIn method returns the state to the backend, and there is no way to verify it. I would like to integrate with casdoor in most secure way 🙂
I need an advice how implement csrf protection using casdoor, while exchange oauth code to token.
Hi, I try to integrate my backend application with casdoor. I use casdoor js sdk: https://github.com/casdoor/casdoor-js-sdk?tab=readme-ov-file and Python Casdoor SDK. In with way I can verify state on backend? Should I save state in backend session before call casdoor? I can see that sdk.signin method send request with code and state, but how can I verify this state on backend? I see that there is method sdk.getOrSaveState(), but is it secure to use this. I want prevent my app of csrf attack.
