Bug: Bad authorization state. Refreshing the page might solve the issue. ( #89
Replies: 12 comments 17 replies
-
|
Could you be running into this issue? https://github.com/soofstad/react-oauth2-pkce#after-redirect-back-from-auth-provider-with-code-no-token-request-is-made Specifically:
|
Beta Was this translation helpful? Give feedback.
-
|
Yeah I read about it and it's not this case. When I'm redirected from my provider everything works fine. It happens when I enter the page -> provider/ library somehow remembers session -> no redirect to provider to login -> error 'bad authorization state...' All my routes are wrapper inside AuthProvider. AuthProvider is in index.sx and App routes in App.tsx one level lower |
Beta Was this translation helpful? Give feedback.
-
|
Are you able to make minimal example on how to recreate this bug? If not, I'd like so see the state of localStorage, both before and after you are redirected to the authentication provider. If everything there looks alright, then you should have a look at what parameters the auth servers sets when it redirects you back after login. |
Beta Was this translation helpful? Give feedback.
-
|
I am also facing a similar issue. My company's QA found a very interesting scenario:
I've done a lot of monitoring and found the following, when there is 'Bad Authirisation State' Error:
Seeing you ask about localstorage I monitored it and found something very interesting: First time: Second Time: Third Time: After logging in: So it seems that the logininProcess is the issue. I tried to check if there isn't a token and logininProcess is false or null to call the login command and it works. But then logging out doesn't. Tried this both with autologin = true and autologin = false. Any help on this issue? |
Beta Was this translation helpful? Give feedback.
-
|
Ok - most updated version: First scenario:
Second scenario: I think in order to reproduce it I need to:
|
Beta Was this translation helpful? Give feedback.
-
|
Have you tried clearing all the web apps persistent data? Calling "logout()" should be enough. If you wan't some more help with this, I realy need an example on how to recreate it. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, |
Beta Was this translation helpful? Give feedback.
-
|
I would also ask about 'logout()' method. Currently when I'm calling this method my tokens are deleted from localStorage but there is no redirect to login again. Is there any possibility to redirect to login again? Sidenote: |
Beta Was this translation helpful? Give feedback.
-
|
If "logoutEndpoint" is provided, calling "logout()" should redirect the user to that URL. |
Beta Was this translation helpful? Give feedback.
-
|
If I'm reading this correctly, you want the user to be sent back to login whenever logout is called - won't |
Beta Was this translation helpful? Give feedback.
-
|
@soofstad no there is no error. I provided logoutEndpoint but after calling logout nothing happens. Only ROCP_tokens are removed from localStorage. To make matter worse it doesn't logout me from provider (OP) - but this is probably due to some configuration on the OP side. @sebastianvitterso after logout I would like to be redirected to provider to login again. Right now I have to make a bypass and manually change url by providing |
Beta Was this translation helpful? Give feedback.
-
|
@pablojakub Do you use Next.js? I am experiencing this same issue right now after migrating over to the new App router. |
Beta Was this translation helpful? Give feedback.
-
|
Hello @soofstad , I'm also encountering this issue |
Beta Was this translation helpful? Give feedback.
-
|
Got a good detailed recreation report from @madtag . Will see if I can find what's causing the issue as soon as I get some time. |
Beta Was this translation helpful? Give feedback.
-
|
Another concern of mine is that when we have this Bad Authorization State, Logout does nothing. It does not try to redirect to keycloak to log in again. So in the case where we send the token in api calls, the api would respond with an 401 Unauthorized error, we would not be able to run logout to redirect to the login page and the user would be left stranded in a gui with no data. |
Beta Was this translation helpful? Give feedback.
-
|
This is a problem you need to work around. You will need to create a solution where you redirect to login page or call the "log in" function when the need arises. |
Beta Was this translation helpful? Give feedback.
-
|
I have another situation where Bad Authorisation State may occur (and I don't think there is much you can do about it to be honest). When you specify a keycloak url that doesn't point to keycloak but somehow returns a 200 response you get the 'Bad Authorization State' error, the gui is loaded anyway and logout does nothing. (Or appears to do nothing) |
Beta Was this translation helpful? Give feedback.
-
|
Another situation where Bad Authorisation State may happen. Configure an invalid redirect_uri. Keycloak will show the error below |
Beta Was this translation helpful? Give feedback.
-
|
@soofstad Is there any ETA on this issue please? Sorry for asking but my manager is pressuring me. |
Beta Was this translation helpful? Give feedback.
-
|
Hey, |
Beta Was this translation helpful? Give feedback.
-
|
@madtag Can you make a minimal example on codesandbox? I don't really know where to begin here yet, but having a repro might help. |
Beta Was this translation helpful? Give feedback.
-
|
From what I can gather, there is no bug, and everything is working as intended. If the user aborts the login process at the auth provider and goes back to the app, we have no other choice than to raise this error. The error in question is a bit vague; 'Bad authorization state. Refreshing the page might solve the issue.' |
Beta Was this translation helpful? Give feedback.
-
|
Now, version 1.15.1 includes a fix where the error is not cleared automatically, and no redirect to logout is made if the user is not logged in. |
Beta Was this translation helpful? Give feedback.
-
|
I am facing the same Bad Authorization State issue, it happens randomly and in my case I do not abort the process of login or do anything with it. If I clear browser history and cache and try to load my app, on first load I am redirected to my auth provider correctly, but if I refresh or open the same app again in a different tab or even in the same tab I browse to the same address, I get into a bad auth state. Then I have to manually reload the page to get it to work. The documentation mentions how we should handle any errors the library throws, is there any way to handle this issue? Something like auto reload the page if the bad auth state error occurs. I am still new to React and I have tried to get around it but no luck. |
Beta Was this translation helpful? Give feedback.
-
|
Sounds like you should create a new issue/discussion @muazshahid. Feel free to do so, and include any related code. Debugging other problems in an old thread isn't sustainable 😄 |
Beta Was this translation helpful? Give feedback.
-
|
This might be unrelated to the problems described here, but we have a page where we encountered the "Bad Authorization State" often in development. It turned out that we used multiple windows with our site in the same browser and when the token needed to be refreshed, multiple instances of the page tried to update the auth tokens at the same time. This resulted in a race condition where the active page sometimes failed with "Bad Authorization State" The solution for us was to change the storage from "local" to "session" as it will not be shared between tabs. This might not be a solution that is generally applicable, but could grant some insight to users ending up here in the future |
Beta Was this translation helpful? Give feedback.
-
|
This exact issue should be fixed in v.1.17.2. Which version are you using? |
Beta Was this translation helpful? Give feedback.
-
|
Interesting! I am using version 1.20.0 |
Beta Was this translation helpful? Give feedback.
-
|
Would much appreciate if you'd create an issue on it. Showing how to recreate the problem 🙂 |
Beta Was this translation helpful? Give feedback.
-
Hello,
In my react React I've got an error when I first time enter the page:
THis may indicates that in my url there is no 'code' query. Indeed there is no 'code' query and after reloading the page it is.
I tried to change settings in my router:
Right now default page redirects to /dashboard. But even when I delete it doesn't work.
In TAuthConfig I have autoLogin: true and clearURL: false,
I'am using this verson:
My expected behaviour - login wihout refreshing the page. Of course I can force login() method but it does not do the trick for me in this case
Beta Was this translation helpful? Give feedback.
All reactions