Dashboard impersonation broken with v3 PKCE/CSRF verification
**Describe the bug**
After upgrading to v3.0.0, impersonating a user from the WorkOS dashboard fails with `Error: Missing required auth parameter`. The v3 PKCE/CSRF verification rejects the callback because dashboard impersonation bypasses the application's proxy/middleware, so the `wos-auth-verifier` cookie and `state` parameter are never set.
Normal sign-in flows work correctly.
**To Reproduce**
1. Set up `@workos-inc/authkit-nextjs` v3.0.0 with the composable proxy pattern (`authkit()` + `handleAuthkitProxy()`) and `handleAuth()` on the callback route
2. Sign in normally to confirm auth works ✅
3. Go to the WorkOS dashboard → Users → select a user → click "Impersonate"
4. WorkOS redirects to `/callback?code=...` (no `state` parameter)
5. See error: `[AuthKit callback error] Error: Missing required auth parameter` → 500
**Expected behavior**
Dashboard impersonation should complete successfully as it did in v2. The impersonation flow is initiated from WorkOS, not from the application, so the application has no opportunity to set the `wos-auth-verifier` cookie or include a `state` parameter.
For reference, a normal sign-in callback includes both:
```
GET /callback?code=01KNN...&state=Fe26.2*1*756e5... → 200
```
But impersonation only includes the code:
```
GET /callback?code=01KNNQAHQBT2FE4Z74QPGMZ9KT → 500
```
**Desktop (please complete the following information):**
- Browser: Chrome
- authkit-nextjs version: 3.0.0
- Next.js version: 16 (using `proxy.js` with composable `authkit()` + `handleAuthkitProxy()` pattern)
**Additional context**
Setup details:
- Callback path is excluded from the proxy matcher (as recommended in the docs)
- Using WorkOS hosted sign-in pages
The root cause is that v3's PKCE/CSRF hardening assumes every callback was initiated by the application (where the proxy sets the cookie + state). Dashboard impersonation initiates from WorkOS itself, skipping that step entirely.
Thanks for the great work on v3, the composable proxy pattern is a really nice improvement! Happy to provide any additional info or test a fix if that would be helpful. 🙏
关闭于 2026-04-09 2 条评论