So I reproduce the steps described by Lane Duncan and I can a slightly different error with OIDC 2.4.0:
Which makes a lot more sense: the current session does not contain any state to compare because the session was actually lost since.
redirect back to the login provider again
While it makes sense in this specific use case, I'm afraid that if the current session is empty for any other reason (like a bad setup) you will end up with an infinite loop. I think I prefer to stop right there with a slightly more accurate error than a weird state comparison. |