OidcClient.readSigninResponseState:在存储中找不到匹配的状态 - oidc-client-js (Angular)

我正在使用 oidc-client library 在我的 Angular(9) 应用程序中与 Azure AD 集成。 signinRedirect()signinSilent() 函数按预期工作。但是对于 signinPopup()它在浏览器 url 片段中成功获取了访问令牌,但它抛出了下面提到的错误

app.component.ts:83 错误:在 oidc-client.min.js:1 的存储中找不到匹配的状态

令人惊讶的是,在 signin-callback.html 中,当我将 response_type 作为查询 var userManager = new Oidc.UserManager({response_mode: "query"}); 传递时,登录弹出窗口成功但登录重定向失败并抱怨

错误:无响应状态

我最初遵循了这个 article

这是我的服务代码:

import { Injectable } from '@angular/core';
import { UserManager, UserManagerSettings, User } from 'oidc-client';

import { environment } from 'src/environments/environment';

@Injectable({
  providedIn: 'root'
})
export class AuthService {
  private userManager: UserManager;

  constructor() {
    this.instantiate();
  }

  private instantiate() {
   this.userManager = new UserManager(this.getOidcSettings());
  }

  public async signinRedirect(): Promise<any> {
    return this.userManager.signinRedirect();
  }

  public async signinSilent(): Promise<User> {
    return this.userManager.signinSilent();
  }

  public async signinPopup(): Promise<User> {
    return this.userManager.signinPopup();
  }

  public async signoutRedirect(): Promise<any> {
    this.userManager.signoutRedirect();
    this.userManager.clearStaleState();
  }

OIDC 设置:

const userManagerSettings: UserManagerSettings = {
      client_id: 'my clientid',
      authority: 'my authority',

      redirect_uri: 'http://localhost:4200/assets/oidc/signin-callback.html',
      silent_redirect_uri: 'http://localhost:4200/assets/oidc/silent-refresh-callback.html',
      post_logout_redirect_uri: 'https://localhost:4200/',

      response_type: 'token',
      response_mode: 'fragment',
      scope: 'my api scope',

      loadUserInfo:false
    };

signin-callback.html

<!DOCTYPE html>
<html lang="en">
  <head>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/oidc-client/1.10.1/oidc-client.min.js"></script>
    <script>
      var userManager = new Oidc.UserManager();

      userManager.signinRedirectCallback().then(
        (user) => {
          alert('signin redirect successful.');
          window.history.replaceState(
            {},
            window.document.title,
            window.location.origin
          );
          window.location = '/';
        },
        (err) => {
          alert('Error caught in signinRedirectCallback()');
          console.log('Error caught in signinRedirectCallback().');
          console.error(err);
        }
      );

      userManager.signinPopupCallback().then(
        (user) => {
          alert('signin pop up successful.');
          window.history.replaceState(
            {},
            window.document.title,
            window.location.origin
          );
          window.location = '/';
        },
        (err) => {
          alert('Error caught in signinPopupCallback()');
          console.log('Error caught in signinPopupCallback().');
          console.error(err);
        }
      );
    </script>
  </head>
  <body></body>
</html>

静默刷新回调.html

<!DOCTYPE html>
<html lang="en">
  <head>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/oidc-client/1.10.1/oidc-client.min.js"></script>
    <script>
      var userManager = new Oidc.UserManager();
      userManager.signinSilentCallback().catch((err) => {
        console.log('Error caught in signinSilentCallback().');
        console.error(err);
      });
    </script>
  </head>
  <body></body>
</html>
stack overflow OidcClient.readSigninResponseState: No matching state found in storage - oidc-client-js (Angular)
原文答案

答案:

作者头像

我们遇到了类似的问题,其中部分用户间歇性地出现此错误。到目前为止,我们已经了解到为什么会发生这种情况的两个具体原因:

  1. 部分系统时钟设置与当前实际时间相差5分钟以上的用户(oidc-client-js中clockSkew默认为5分钟)

  2. 一些用户正在共享和重复使用由 Identity Server 生成的带有安全参数的唯一生成的登录 URL。可以使用身份服务器登录,但像 nonce 这样的安全变量不匹配(最终在 oidc-signin 回调中抛出“在存储中未找到匹配状态”错误)

作者头像

它也发生在我身上,就我而言,我们使用 https 配置了 Identity Server 站点,我试图访问旧的书签 URL,它被存储为 http。

这给我带来了同样的 OIDC 问题。将 URL 恢复为 https 后,一切都对我有用。

相关问题