{"action":"created","issue":{"url":"https://api.github.com/repos/DoSomething/phoenix-next/issues/301","repository_url":"https://api.github.com/repos/DoSomething/phoenix-next","labels_url":"https://api.github.com/repos/DoSomething/phoenix-next/issues/301/labels{/name}","comments_url":"https://api.github.com/repos/DoSomething/phoenix-next/issues/301/comments","events_url":"https://api.github.com/repos/DoSomething/phoenix-next/issues/301/events","html_url":"https://github.com/DoSomething/phoenix-next/issues/301","id":234653299,"number":301,"title":"Occasional OAuth state token errors on login.","user":{"login":"DFurnes","id":583202,"avatar_url":"https://avatars1.githubusercontent.com/u/583202?v=4","gravatar_id":"","url":"https://api.github.com/users/DFurnes","html_url":"https://github.com/DFurnes","followers_url":"https://api.github.com/users/DFurnes/followers","following_url":"https://api.github.com/users/DFurnes/following{/other_user}","gists_url":"https://api.github.com/users/DFurnes/gists{/gist_id}","starred_url":"https://api.github.com/users/DFurnes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DFurnes/subscriptions","organizations_url":"https://api.github.com/users/DFurnes/orgs","repos_url":"https://api.github.com/users/DFurnes/repos","events_url":"https://api.github.com/users/DFurnes/events{/privacy}","received_events_url":"https://api.github.com/users/DFurnes/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-06-08T20:54:01Z","updated_at":"2018-03-16T16:24:12Z","closed_at":null,"author_association":"OWNER","body":"We've occasionally seen mismatched OAuth state tokens when trying to log into Phoenix Next. I'm able to reproduce across environments, but luckily this seems to have occurred [only 6 times over the past week](https://rpm.newrelic.com/accounts/108038/applications/41357464/traced_errors) on production.\r\n\r\nI added some logging when taking a quick look on my local and it seems like we're not correctly wiping \"old\" state tokens from the session when a user makes sequential login attempts. It's trying to compare the new state from the query string against the one generated for the previous successful login:\r\n\r\n```\r\n[2017-06-08 19:20:37] local.DEBUG: authorize {\"query\":{\"destination\":\"Sincerely, Us\"}} \r\n[2017-06-08 19:20:37] local.DEBUG: saving state token {\"state\":\"479c83dc40fde58aec5b8267df07b9af\"} \r\n[2017-06-08 19:20:39] local.DEBUG: authorize {\"query\":{\"code\":\"gbB1otK/31BrCJbDhGRZZTcKZNNpIcuOMynN6dbsqy2+biysmQXx1EKWB2C6TXt/A/sCRq22KUIVuTP6vi5AwQup0YkVBeeXf2wlkkMWLib3optbtZWGfaSOxmiWZ///hZzbpiUTu1Iesn1AdyUkqEhS47v57ZVSIYkJg/PSPbaiGHQzSPZ6/r80Rx4GcXpQLBSv/x9z3twmNR+ilFfAsim/Uml32/dKrHYDM/NyJ0vzHLWqhbgP7X+JrPNQssi9n3RfsAaJQNBp4SaN+7WzI+bpnvBfJya6QNz/bwQsz2mwuXmmVlujJ6KIEDTBeO9uA5uX9B7ND4A7jaHuQv+ffKCUMzSr9fM69CvHOMLtijWo0TF7/hAzwt8lbSKYBMd3oxQsACfPEQWc4YhvPy+CFwIJByRuRXEE1CTs4j5SfrLBBEKW3ueiAZcs20UEj+EsB2hwrUTmyIj5HGz4kGEJK2neN44Ic52EvxW0OrVXV4Zs/bMfCFkXwcIQ61ZL/7+Ysq/awC74YYI1EYiMa9nLTIzssEgFF9FcLbd3uci4T1CfF+IbSkYeTZ0Zsgg3q32UqtceaK2OJOwHASEmhwsTcdcfUSqJ/qH6O9pkofyDvvi7Kv1oV39/0wab2p199XTTgb7fk2f98xz7ycHnzr/26Y33Hb4/wjnHYUfCKIOfaqM=\",\"state\":\"479c83dc40fde58aec5b8267df07b9af\"}} \r\n[2017-06-08 19:20:39] local.DEBUG: comparing state token {\"state\":\"479c83dc40fde58aec5b8267df07b9af\",\"query.state\":\"479c83dc40fde58aec5b8267df07b9af\"} \r\n[2017-06-08 19:20:46] local.DEBUG: authorize {\"query\":{\"destination\":\"Sincerely, Us\"}} \r\n[2017-06-08 19:20:46] local.DEBUG: saving state token {\"state\":\"4f544202b1e75cb425a086c38e195ec2\"} \r\n[2017-06-08 19:20:48] local.DEBUG: authorize {\"query\":{\"code\":\"EkFZRnQy/+zzVz/9q3TdNdo2WPek1NTEGvIj705C3hvsKGIQYNr7suBaBs/bmpxP1So6jitMktTrJIbXQaNFowP19GJg12yH6Z6C5jxH17k69PNJs7z2B/xvtclTabUKqdVqvI9o+EG8IO5F/uFkoZFpTa+JFgCpmNN97T3yikCFwrlVRuDl3DqHuzkO40rML/hVW7LDkUbjqjNtgB4ZYFxkdPLK2SDN2mJL2PVkFXKjszi2jlirhk6CxsKbkWXCF1+LkWkyGdnodUAI1Kx0SUOyckE6N3MQXBWCNaJIscowlUVa8rGkUTerE6IoATyrCBHjjkiZge9/nJwH4iNj67iR38FJsjbW6A323gGbnkLyisjjdJGzRoD4c7X3CAAbTvP2mI7OaoIYrcHKK4QYoVfjMqiFUepwvsgWERI4XaaSAEwgJlx+X6EiMzrOkCMn2/xC7ypy7mvYfxW0M/ofQe4H5GzZa8cKbxgLExe4OiCe1QLgeK7nX94C7UGeBhZNSG2tZLh8vhqbdA1uUaDy+iFROIhuwlBw3SLmSp1r7PW9z6N9xnBLbFW8fSTpNxx5K2t/nrB06KeKlUnTrL73ZlZo0+Dgn15HA9ZZOps+S4vLLb4Jz2WOVg6jcFx/2ntJmU2n5DGrIJG4XOTU4oOWi4qH60iBgVIxkWGTjGFmF6w=\",\"state\":\"4f544202b1e75cb425a086c38e195ec2\"}} \r\n[2017-06-08 19:20:48] local.DEBUG: comparing state token {\"state\":\"479c83dc40fde58aec5b8267df07b9af\",\"query.state\":\"4f544202b1e75cb425a086c38e195ec2\"} \r\n[2017-06-08 19:20:48] local.ERROR: DoSomething\\Gateway\\Exceptions\\InternalException: Exception from \"[authorization_code]\": [500] The OAuth state field did not match. in /home/vagrant/Sites/phoenix-next/vendor/dosomething/gateway/src/AuthorizesWithNorthstar.php:160 \r\n```\r\n\r\nI've been unable to reproduce on other Gateway-powered apps, so seems like something unique here."},"comment":{"url":"https://api.github.com/repos/DoSomething/phoenix-next/issues/comments/373767443","html_url":"https://github.com/DoSomething/phoenix-next/issues/301#issuecomment-373767443","issue_url":"https://api.github.com/repos/DoSomething/phoenix-next/issues/301","id":373767443,"user":{"login":"weerd","id":105849,"avatar_url":"https://avatars1.githubusercontent.com/u/105849?v=4","gravatar_id":"","url":"https://api.github.com/users/weerd","html_url":"https://github.com/weerd","followers_url":"https://api.github.com/users/weerd/followers","following_url":"https://api.github.com/users/weerd/following{/other_user}","gists_url":"https://api.github.com/users/weerd/gists{/gist_id}","starred_url":"https://api.github.com/users/weerd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/weerd/subscriptions","organizations_url":"https://api.github.com/users/weerd/orgs","repos_url":"https://api.github.com/users/weerd/repos","events_url":"https://api.github.com/users/weerd/events{/privacy}","received_events_url":"https://api.github.com/users/weerd/received_events","type":"User","site_admin":false},"created_at":"2018-03-16T16:24:12Z","updated_at":"2018-03-16T16:24:12Z","author_association":"OWNER","body":"Ya @DFurnes. Mind turning this into a PT ticket? I'm trying to cleanup the issues on GH since now PT integrates better w/ GH. Want to leave issues just for large Features that need to be broken down into a sort of checklist (and if desired to use an issue to help a dev track that)."}}
{"actor":{"display_login":"weerd"}}