Branch/Environment
- Branch: Master
- Environment: On-prem
Describe the bug
In the current implementation tib only uses a hard coded state value, this violates the RFC 6749 that requires an opaque non guessable value. At least the initiator of the call should be able to pass a different value.
Reproduction steps
Steps to reproduce the behavior:
See https://github.com/TykTechnologies/tyk-identity-broker/blob/a68a680c31d00b7eec4e222ed7534600f88dcc12/tothic/tothic.go#L136C1-L138C1
Actual behavior
State is always state
Expected behavior
State is either an random opaque value or taken from the value the caller send.
Additional context
This bug was also reported as tyk support case #18436 and this resulted in the feature request TT-11298
Branch/Environment
Describe the bug
In the current implementation tib only uses a hard coded state value, this violates the RFC 6749 that requires an opaque non guessable value. At least the initiator of the call should be able to pass a different value.
Reproduction steps
Steps to reproduce the behavior:
See https://github.com/TykTechnologies/tyk-identity-broker/blob/a68a680c31d00b7eec4e222ed7534600f88dcc12/tothic/tothic.go#L136C1-L138C1
Actual behavior
State is always
stateExpected behavior
State is either an random opaque value or taken from the value the caller send.
Additional context
This bug was also reported as tyk support case #18436 and this resulted in the feature request TT-11298