Change state value for api based auth

wso2-extensions · Nov 29, 2023 · ee7fb05 · ee7fb05
1 parent 552cf6d
commit ee7fb05
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 3 deletions.
diff --git a/...va/org/wso2/carbon/identity/application/authenticator/facebook/FacebookAuthenticator.java b/...va/org/wso2/carbon/identity/application/authenticator/facebook/FacebookAuthenticator.java
@@ -86,6 +86,7 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.UUID;
 import java.util.stream.Collectors;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -232,7 +233,14 @@ protected void initiateAuthenticationRequest(HttpServletRequest request,
                 callbackUrl = (String) context.getProperty(FacebookAuthenticatorConstants.REDIRECT_URL);
             }
 
-            String state = context.getContextIdentifier() + "," + FacebookAuthenticatorConstants.FACEBOOK_LOGIN_TYPE;
+            String state;
+            if (FrameworkUtils.isAPIBasedAuthenticationFlow(request)) {
+                state = UUID.randomUUID() + "," + FacebookAuthenticatorConstants.FACEBOOK_LOGIN_TYPE;
+            } else {
+                state = context.getContextIdentifier() + "," + FacebookAuthenticatorConstants.FACEBOOK_LOGIN_TYPE;
+            }
+            context.setProperty(FacebookAuthenticatorConstants.AUTHENTICATOR_NAME +
+                    FacebookAuthenticatorConstants.STATE_PARAM_SUFFIX, state);
 
             OAuthClientRequest authzRequest =
                     OAuthClientRequest.authorizationLocation(authorizationEP)
@@ -321,6 +329,11 @@ private static AdditionalData getAdditionalData(
             additionalData.setRedirectUrl((String) context.getProperty(
                     FacebookAuthenticatorConstants.AUTHENTICATOR_NAME +
                     FacebookAuthenticatorConstants.REDIRECT_URL_SUFFIX));
+            Map<String, String> additionalAuthenticationParams = new HashMap<>();
+            String state = (String) context.getProperty(FacebookAuthenticatorConstants.AUTHENTICATOR_NAME +
+                    FacebookAuthenticatorConstants.STATE_PARAM_SUFFIX);
+            additionalAuthenticationParams.put(FacebookAuthenticatorConstants.OAUTH2_PARAM_STATE, state);
+            additionalData.setAdditionalAuthenticationParams(additionalAuthenticationParams);
         }
         return additionalData;
     }
@@ -635,7 +648,7 @@ protected boolean shouldPrefixClaimDialectUri() {
     public String getContextIdentifier(HttpServletRequest request) {
         log.trace("Inside FacebookAuthenticator.getContextIdentifier()");
 
-        if (isNativeSDKBasedFederationCall(request)) {
+        if (FrameworkUtils.isAPIBasedAuthenticationFlow(request)) {
             return request.getParameter(FacebookAuthenticatorConstants.SESSION_DATA_KEY_PARAM);
         }
 

diff --git a/...o2/carbon/identity/application/authenticator/facebook/FacebookAuthenticatorConstants.java b/...o2/carbon/identity/application/authenticator/facebook/FacebookAuthenticatorConstants.java
@@ -57,6 +57,7 @@ public class FacebookAuthenticatorConstants {
     public static final String SESSION_DATA_KEY_PARAM = "sessionDataKey";
     public static final String CLIENT_ID_PARAM = "clientId";
     public static final String REDIRECT_URL_SUFFIX = "_redirect_url";
+    public static final String STATE_PARAM_SUFFIX = "_state_param";
     public static final String IS_API_BASED = "IS_API_BASED";
     public static final String REDIRECT_URL = "REDIRECT_URL";
 

diff --git a/pom.xml b/pom.xml
@@ -231,7 +231,7 @@
 
     <properties>
         <!--Carbon framework version-->
-        <carbon.identity.framework.version>5.25.509</carbon.identity.framework.version>
+        <carbon.identity.framework.version>5.25.560</carbon.identity.framework.version>
         <identity.outbound.auth.facebook.export.version>${project.version}</identity.outbound.auth.facebook.export.version>
         <carbon.identity.framework.import.version.range>[5.25.260, 7.0.0)</carbon.identity.framework.import.version.range>