From 081fe6045352e064af44fdf8cc7c63b88644e1e0 Mon Sep 17 00:00:00 2001
From: Govindarajan Nagarajan <govindarajan.nagarajan@zalando.de>
Date: Mon, 3 Aug 2020 15:53:22 +0200
Subject: [PATCH] Refactor: parse state query param to read nonce

The `state` was modified to be an encoded object of `nonce` and `env`.
When verifying the Nonce value in the callback from the authorization
server, parse the state parameter string to read the right value of
nonce
---
 plugins/auth-backend/src/lib/OAuthProvider.ts | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/plugins/auth-backend/src/lib/OAuthProvider.ts b/plugins/auth-backend/src/lib/OAuthProvider.ts
index ca8872cd95..d92d31c4ff 100644
--- a/plugins/auth-backend/src/lib/OAuthProvider.ts
+++ b/plugins/auth-backend/src/lib/OAuthProvider.ts
@@ -42,8 +42,13 @@ export type Options = {
 /* Return the value of `env` key, if it is exists, encoded within
      the `state` parameter in the request
   */
-const getEnv = (stateParams: Array<string>): string => {
-  const envParams = stateParams.filter(param => param.split('=')[0] === 'env');
+const readStateParameter = (
+  stateParams: Array<string>,
+  parameter: string,
+): string => {
+  const envParams = stateParams.filter(
+    param => param.split('=')[0] === parameter,
+  );
 
   if (envParams.length > 0) {
     return envParams[0].split('=')[1];
@@ -54,9 +59,11 @@ const getEnv = (stateParams: Array<string>): string => {
 const readState = (stateString: string): Array<string> => {
   return decodeURIComponent(stateString).split('&');
 };
+
 export const verifyNonce = (req: express.Request, providerId: string) => {
   const cookieNonce = req.cookies[`${providerId}-nonce`];
-  const stateNonce = req.query.state;
+  const state = req.query.state;
+  const stateNonce = readStateParameter(state, 'nonce');
 
   if (!cookieNonce) {
     throw new Error('Auth response is missing cookie nonce');
@@ -257,11 +264,11 @@ export class OAuthProvider implements AuthProviderRouteHandlers {
     if (reqEnv) {
       return reqEnv;
     }
-    const stateParam = req.query.state?.toString();
-    if (!stateParam) {
+    const stateParams = req.query.state?.toString();
+    if (!stateParams) {
       return '';
     }
-    const env = getEnv(readState(stateParam));
+    const env = readStateParameter(readState(stateParams), 'env');
     return env;
   }