fix: fix nonce in redirect function in AbstractProvider

Author: albertcht

src/socialite/src/Two/AbstractProvider.php

@@ -74,7 +74,7 @@ public function __construct(
     /**
      * Get the authentication URL for the provider.
      */
-    abstract protected function getAuthUrl(string $state): string;
+    abstract protected function getAuthUrl(?string $state): string;
 
     /**
      * Get the token URL for the provider.
@@ -114,7 +114,7 @@ public function redirect(): ResponseInterface
     /**
      * Build the authentication URL for the provider from the given base URL.
      */
-    protected function buildAuthUrlFromBase(string $url, string $state): string
+    protected function buildAuthUrlFromBase(string $url, ?string $state): string
     {
         return $url . '?' . http_build_query($this->getCodeFields($state), '', '&', $this->encodingType);
     }

src/socialite/src/Two/BitbucketProvider.php

@@ -20,7 +20,7 @@ class BitbucketProvider extends AbstractProvider implements ProviderInterface
      */
     protected string $scopeSeparator = ' ';
 
-    protected function getAuthUrl(string $state): string
+    protected function getAuthUrl(?string $state): string
     {
         return $this->buildAuthUrlFromBase('https://bitbucket.org/site/oauth2/authorize', $state);
     }

src/socialite/src/Two/FacebookProvider.php

@@ -44,7 +44,7 @@ class FacebookProvider extends AbstractProvider implements ProviderInterface
      */
     protected bool $reRequest = false;
 
-    protected function getAuthUrl(string $state): string
+    protected function getAuthUrl(?string $state): string
     {
         return $this->buildAuthUrlFromBase('https://www.facebook.com/' . $this->getGraphVersion() . '/dialog/oauth', $state);
     }

src/socialite/src/Two/GithubProvider.php

@@ -15,7 +15,7 @@ class GithubProvider extends AbstractProvider implements ProviderInterface
      */
     protected array $scopes = ['user:email'];
 
-    protected function getAuthUrl(string $state): string
+    protected function getAuthUrl(?string $state): string
     {
         return $this->buildAuthUrlFromBase('https://github.com/login/oauth/authorize', $state);
     }

src/socialite/src/Two/GitlabProvider.php

@@ -35,7 +35,7 @@ public function setHost(?string $host): static
         return $this;
     }
 
-    protected function getAuthUrl(string $state): string
+    protected function getAuthUrl(?string $state): string
     {
         return $this->buildAuthUrlFromBase($this->host . '/oauth/authorize', $state);
     }

src/socialite/src/Two/GoogleProvider.php

@@ -23,7 +23,7 @@ class GoogleProvider extends AbstractProvider implements ProviderInterface
         'email',
     ];
 
-    protected function getAuthUrl(string $state): string
+    protected function getAuthUrl(?string $state): string
     {
         return $this->buildAuthUrlFromBase('https://accounts.google.com/o/oauth2/auth', $state);
     }

src/socialite/src/Two/LinkedInOpenIdProvider.php

@@ -18,7 +18,7 @@ class LinkedInOpenIdProvider extends AbstractProvider implements ProviderInterfa
      */
     protected string $scopeSeparator = ' ';
 
-    protected function getAuthUrl(string $state): string
+    protected function getAuthUrl(?string $state): string
     {
         return $this->buildAuthUrlFromBase('https://www.linkedin.com/oauth/v2/authorization', $state);
     }

src/socialite/src/Two/LinkedInProvider.php

@@ -19,7 +19,7 @@ class LinkedInProvider extends AbstractProvider implements ProviderInterface
      */
     protected string $scopeSeparator = ' ';
 
-    protected function getAuthUrl(string $state): string
+    protected function getAuthUrl(?string $state): string
     {
         return $this->buildAuthUrlFromBase('https://www.linkedin.com/oauth/v2/authorization', $state);
     }

src/socialite/src/Two/OpenIdProvider.php

@@ -45,11 +45,44 @@ abstract protected function getBaseUrl(): string;
      */
     public function redirect(): ResponseInterface
     {
+        $state = null;
+        $nonce = null;
+
+        if ($this->usesState()) {
+            $this->request->session()->put('state', $state = $this->getState());
+        }
+
+        if ($this->usesPKCE()) {
+            $this->request->session()->put('code_verifier', $this->getCodeVerifier());
+        }
+
         if ($this->usesNonce()) {
-            $this->request->session()->put('nonce', $this->getNonce());
+            $this->request->session()->put('nonce', $nonce = $this->getNonce());
         }
 
-        return parent::redirect();
+        return $this->response->redirect(
+            $this->getAuthUrl($state, $nonce)
+        );
+    }
+
+    /**
+     * Get the authentication URL for the provider.
+     */
+    protected function getAuthUrl(?string $state, ?string $nonce = null): string
+    {
+        return $this->buildAuthUrlFromBase(
+            $this->getOpenIdConfig()['authorization_endpoint'],
+            $state,
+            $nonce
+        );
+    }
+
+    /**
+     * Build the authentication URL for the provider from the given base URL.
+     */
+    protected function buildAuthUrlFromBase(string $url, ?string $state, ?string $nonce = null): string
+    {
+        return $url . '?' . http_build_query($this->getCodeFields($state, $nonce), '', '&', $this->encodingType);
     }
 
     /**
@@ -76,26 +109,15 @@ protected function getJwksUri(): string
         return $this->getOpenIdConfig()['jwks_uri'];
     }
 
-    /**
-     * Get the authentication URL for the provider.
-     */
-    protected function getAuthUrl(string $state): string
-    {
-        return $this->buildAuthUrlFromBase(
-            $this->getOpenIdConfig()['authorization_endpoint'],
-            $state
-        );
-    }
-
     /**
      * Get the GET parameters for the code request.
      */
-    protected function getCodeFields(?string $state = null): array
+    protected function getCodeFields(?string $state = null, ?string $nonce = null): array
     {
         $fields = parent::getCodeFields($state);
 
-        if ($this->usesState()) {
-            $fields['state'] = $state;
+        if ($this->usesNonce()) {
+            $fields['nonce'] = $nonce;
         }
 
         return $fields;

src/socialite/src/Two/SlackOpenIdProvider.php

@@ -19,7 +19,7 @@ class SlackOpenIdProvider extends AbstractProvider implements ProviderInterface
      */
     protected string $scopeSeparator = ' ';
 
-    protected function getAuthUrl(string $state): string
+    protected function getAuthUrl(?string $state): string
     {
         return $this->buildAuthUrlFromBase('https://slack.com/openid/connect/authorize', $state);
     }