Verify OAuth/OIDC state in callbacks to prevent login CSRF

[dimafa]

What

Both login handlers generate a random state and store it in a cookie:

• HandleGitHubLogin → oauthstate cookie
• HandleOIDCLogin → oidc_state cookie

…but neither callback ever verifies it. HandleGitHubCallback and HandleOIDCCallback go straight to the token exchange without comparing r.FormValue("state") to the cookie.

Why it matters

This leaves both OAuth/OIDC callbacks open to login CSRF: an attacker can force a victim's browser to complete a login with the attacker's authorization code, logging the victim into the attacker's account (or attaching the attacker's identity), which can be used to seed content the attacker can later read, etc. State verification is the standard OAuth defense and the cookie is already being set — it just wasn't checked.

Change

In both callbacks, read the corresponding cookie and compare it to the returned state, redirecting to / on missing/mismatched state:

stateCookie, err := r.Cookie("oidc_state") // or "oauthstate"
if err != nil || stateCookie.Value == "" || r.FormValue("state") != stateCookie.Value {
    logrus.Error("invalid oidc state in callback")
    http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
    return
}

Behavior is unchanged for legitimate logins (the login handler already sets the cookie and passes the same state to the IdP via AuthCodeURL). Builds clean (go build ./...).

[gemini-code-assist]

Code Review

This pull request introduces state parameter verification against the oauthstate and oidc_state cookies in the GitHub and OIDC OAuth callback handlers to prevent login CSRF. The review feedback recommends clearing these state cookies immediately after verification to prevent replay attacks or state reuse, and suggests explicitly setting the cookie path to / for the GitHub OAuth state cookie to avoid potential path mismatch issues.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

It is highly recommended to clear the oauthstate cookie immediately after verifying it to prevent replay attacks or state reuse.

Additionally, please note that generateStateOauthCookie (defined on line 163) does not set an explicit Path on the cookie. This means the cookie defaults to the path of the login handler. If the callback handler is hosted on a different path hierarchy, the browser will not send the oauthstate cookie, causing the state verification to fail. You should update generateStateOauthCookie to set Path: "/" as well.

Suggested change

	stateCookie, err := r.Cookie("oauthstate")
	if err != nil || stateCookie.Value == "" || r.FormValue("state") != stateCookie.Value {
	logrus.Error("invalid oauth state in github callback")
	http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
	return
	}
	stateCookie, err := r.Cookie("oauthstate")
	if err != nil || stateCookie.Value == "" || r.FormValue("state") != stateCookie.Value {
	logrus.Error("invalid oauth state in github callback")
	http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
	return
	}
	// Clear the state cookie to prevent reuse
	http.SetCookie(w, &http.Cookie{
	Name: "oauthstate",
	Value: "",
	Path: "/",
	MaxAge: -1,
	HttpOnly: true,
	})

[gemini-code-assist]

It is highly recommended to clear the oidc_state cookie immediately after verifying it to prevent replay attacks or state reuse. Since HandleOIDCLogin sets the cookie with Path: "/", we can safely clear it using the same path.

Suggested change

	stateCookie, err := r.Cookie("oidc_state")
	if err != nil || stateCookie.Value == "" || r.FormValue("state") != stateCookie.Value {
	logrus.Error("invalid oidc state in callback")
	http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
	return
	}
	stateCookie, err := r.Cookie("oidc_state")
	if err != nil || stateCookie.Value == "" || r.FormValue("state") != stateCookie.Value {
	logrus.Error("invalid oidc state in callback")
	http.Redirect(w, r, "/", http.StatusTemporaryRedirect)
	return
	}
	// Clear the state cookie to prevent reuse
	http.SetCookie(w, &http.Cookie{
	Name: "oidc_state",
	Value: "",
	Path: "/",
	MaxAge: -1,
	HttpOnly: true,
	})

[dimafa]

Thanks — both applied:

• generateStateOauthCookie now sets Path: "/" (matching oidc_state) so the cookie reliably reaches the callback.
• Both callbacks now clear the state cookie after a successful verification, making it single-use.