OAuth2.0 provider issue: Missing `state` parameter in callback

XMLWordPrintable

    • 1
    • Severity 3 - Minor

      Issue Summary

      In the Bitbucket Data Center, there is an issue with the OAuth2.0 provider. When a user denies consent, the `state` parameter is missing in the callback. This violates RFC6749 section 4.1.2.1 and causes CSRF prevention and integration issues.

      Steps to Reproduce

      1. Setup Oauth2-based Application Link on Bitbucket DC
      2. Initiate a Request from the OAuth Client App nd deny the Consent

      Expected Results

      The return callback reponse hsould also have the `state` parameter

      Actual Results

      It doesn't have the state parameter included when consent is denied; only the state is passed when the Consent is Approved or Allowed

      Workaround

      Currently there is no known workaround for this behavior. A workaround will be added here when available

            Assignee:
            David Jansons
            Reporter:
            Danny Samuel
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: