Possible security bug in the web api auth example from gitbub

alexlindgren — Sun, 03 Jan 2021 15:16:08 GMT

I've cloned the code from: https://github.com/spotify/web-api-auth-examples and possibly found some security bug - but please correct me and explain why I'm wrong if that is the case.

State is set in /login route to

var state = generateRandomString(16); res.cookie(stateKey, state);

And then updated and checked in /callback route with

var state = req.query.state || null; var storedState = req.cookies ? req.cookies[stateKey] : null if (state === null || state !== storedState) {

As "state" is overwritten with the users incoming query.state, wouldn't that mean that if a users traffic was interrupted by a malicious user, they could just use whatever string they wanted in their query, as long as it corresponded to their cookie and overtake the connection? Why do you overwrite the state variable at all? Shouldn't it be kept the same as when assigned in the /login route and then used as a basis for comparison and security?

topic Possible security bug in the web api auth example from gitbub in Spotify for Developers

Possible security bug in the web api auth example from gitbub