Skip to content

Update diagnostic errors for missing state in logout responses #977

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
w-goog wants to merge 9 commits into
base: master
Choose a base branch
from
Open

Update diagnostic errors for missing state in logout responses #977

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
dbb0e3f
g-orchestrated: distinguish missing vs mismatched state in end sessio…
w-goog Aug 25, 2026
d513ea8
g-orchestrated: CHANGELOG entry for state validation error diagnostics
w-goog Aug 25, 2026
f674416
g-orchestrated: distinguish missing vs mismatched state in authorizat…
w-goog Aug 25, 2026
0d8da48
g-orchestrated: reword end session state remedy for nonnull state par…
w-goog Aug 25, 2026
642ff5d
Merge codegen/state-diagnostics-lib
w-goog Aug 25, 2026
e227062
Merge codegen/state-diagnostics-docs
w-goog Aug 25, 2026
2bda74c
g-orchestrated: tighten state validation messages and drop unsupporte…
w-goog Aug 25, 2026
69cca08
g-orchestrated: soften end session endpoint cause to may rather than …
w-goog Aug 25, 2026
fd6f698
g-orchestrated: cite OpenID Connect Core alongside RFC 6749 for state…
w-goog Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,6 @@
# UNRELEASED
- Improved the state validation error messages to distinguish a missing `state` parameter from a mismatched one. The end session message now notes that a provider's `end_session_endpoint` may point at a legacy or SAML single-logout endpoint, which does not echo `state`. Addresses issue #956.

# 3.0.0
- BREAKING: Updates made to support Xcode 27. ([#972](https://github.com/openid/AppAuth-iOS/pull/972), [#973](https://github.com/openid/AppAuth-iOS/pull/973))
-- Raised minimum deployment targets to iOS 15.0, macOS 12.0, tvOS 15.0 and watchOS 9.0 (minimum for Xcode 27).
Expand Down
47 changes: 35 additions & 12 deletions Sources/AppAuthCore/OIDAuthorizationService.m
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,12 +170,22 @@ - (BOOL)resumeExternalUserAgentFlowWithURL:(NSURL *)URL error:(NSError *_Nullabl
// verifies that the state in the response matches the state in the request, or both are nil
if (!OIDIsEqualIncludingNil(_request.state, response.state)) {
NSMutableDictionary *userInfo = [query.dictionaryValue mutableCopy];
userInfo[NSLocalizedDescriptionKey] =
[NSString stringWithFormat:@"State mismatch, expecting %@ but got %@ in authorization "
"response %@",
_request.state,
response.state,
response];
if (response.state == nil) {
userInfo[NSLocalizedDescriptionKey] =
[NSString stringWithFormat:@"The authorization response is missing the state parameter, "
"expecting %@. RFC 6749 section 4.1.2 and OpenID Connect "
"Core section 3.1.2.5 require the authorization server to "
"echo the exact state value from the request. Response: %@",
_request.state,
response];
} else {
userInfo[NSLocalizedDescriptionKey] =
[NSString stringWithFormat:@"State mismatch, expecting %@ but got %@ in authorization "
"response %@",
_request.state,
response.state,
response];
}
response = nil;
responseError = [NSError errorWithDomain:OIDOAuthAuthorizationErrorDomain
code:OIDErrorCodeOAuthAuthorizationClientError
Expand Down Expand Up @@ -307,12 +317,25 @@ - (BOOL)resumeExternalUserAgentFlowWithURL:(NSURL *)URL error:(NSError *_Nullabl
// verifies that the state in the response matches the state in the request, or both are nil
if (!OIDIsEqualIncludingNil(_request.state, response.state)) {
NSMutableDictionary *userInfo = [query.dictionaryValue mutableCopy];
userInfo[NSLocalizedDescriptionKey] =
[NSString stringWithFormat:@"State mismatch, expecting %@ but got %@ in authorization "
"response %@",
_request.state,
response.state,
response];
if (!response.state) {

@brnnmrls brnnmrls Sep 1, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: consider updating to response.state == nil to be consisten with line 173 in Sources/AppAuthCore/OIDAuthorizationService.m ?

userInfo[NSLocalizedDescriptionKey] =
[NSString stringWithFormat:@"The end session response is missing the state parameter, "
"expecting %@. This may mean end_session_endpoint is not "
"an OpenID Connect RP-Initiated Logout endpoint; some "
"providers advertise a legacy or SAML single-logout "
"endpoint under that key, and those do not echo state. "
"Check end_session_endpoint in the provider's discovery "
"document. Response: %@",
_request.state,
response];
} else {
userInfo[NSLocalizedDescriptionKey] =
[NSString stringWithFormat:@"State in the end session response does not match the "
"request, expecting %@ but got %@. Response: %@",
_request.state,
response.state,
response];
}
response = nil;
responseError = [NSError errorWithDomain:OIDOAuthAuthorizationErrorDomain
code:OIDErrorCodeOAuthAuthorizationClientError
Expand Down