bump 0.5.28 — disable state check for SSO test

2026-06-09 21:53:07 +04:00
parent 61361ec7e2
commit 6c5215513c
2 changed files with 9 additions and 5 deletions
@@ -32,11 +32,15 @@ function createRouter({ auth, doubleCsrfProtection, generateCsrfToken, authLimit
  router.get('/callback', async (req, res) => {
    const { code, state } = req.query;

+    // ⚠️ ВРЕМЕННО: проверка state отключена для тестирования (2026-06-09)
+    // 🔮 Вернуть когда заработает SSO на managed
    // Проверка state (защита от CSRF на callback)
-    if (!state || state !== req.session.oidcState) {
-      return res.status(403).send('Invalid state parameter');
-    }
-    delete req.session.oidcState;
+    // if (!state || state !== req.session.oidcState) {
+    //   return res.status(403).send('Invalid state parameter');
+    // }
+    // delete req.session.oidcState;
+
+    if (req.session) delete req.session.oidcState;

    if (!code) {
      return res.status(400).send('Missing authorization code');