ITADN

Dashboard impersonation broken with v3 PKCE/CSRF verification

#400Closedjosh-respectx 创建于 2026-04-08
J
josh-respectxcommented
**Describe the bug** After upgrading to v3.0.0, impersonating a user from the WorkOS dashboard fails with `Error: Missing required auth parameter`. The v3 PKCE/CSRF verification rejects the callback because dashboard impersonation bypasses the application's proxy/middleware, so the `wos-auth-verifier` cookie and `state` parameter are never set. Normal sign-in flows work correctly. **To Reproduce** 1. Set up `@workos-inc/authkit-nextjs` v3.0.0 with the composable proxy pattern (`authkit()` + `handleAuthkitProxy()`) and `handleAuth()` on the callback route 2. Sign in normally to confirm auth works ✅ 3. Go to the WorkOS dashboard → Users → select a user → click "Impersonate" 4. WorkOS redirects to `/callback?code=...` (no `state` parameter) 5. See error: `[AuthKit callback error] Error: Missing required auth parameter` → 500 **Expected behavior** Dashboard impersonation should complete successfully as it did in v2. The impersonation flow is initiated from WorkOS, not from the application, so the application has no opportunity to set the `wos-auth-verifier` cookie or include a `state` parameter. For reference, a normal sign-in callback includes both: ``` GET /callback?code=01KNN...&state=Fe26.2*1*756e5... → 200 ``` But impersonation only includes the code: ``` GET /callback?code=01KNNQAHQBT2FE4Z74QPGMZ9KT → 500 ``` **Desktop (please complete the following information):** - Browser: Chrome - authkit-nextjs version: 3.0.0 - Next.js version: 16 (using `proxy.js` with composable `authkit()` + `handleAuthkitProxy()` pattern) **Additional context** Setup details: - Callback path is excluded from the proxy matcher (as recommended in the docs) - Using WorkOS hosted sign-in pages The root cause is that v3's PKCE/CSRF hardening assumes every callback was initiated by the application (where the proxy sets the cookie + state). Dashboard impersonation initiates from WorkOS itself, skipping that step entirely. Thanks for the great work on v3, the composable proxy pattern is a really nice improvement! Happy to provide any additional info or test a fix if that would be helpful. 🙏
关闭于 2026-04-09 2 条评论