当使用AtlassianOAuth2与Django一起使用回调URI时，得到 "AuthStateMissing......Session值状态丢失"。

Question

我试图在一个Django应用中设置oauth2认证。这是我的设置。

*other parts ommited*
# AUTH STUFF

AUTHENTICATION_BACKENDS = (
    'social_core.backends.atlassian.AtlassianOAuth2',
    'django.contrib.auth.backends.ModelBackend',
)

SOCIAL_AUTH_ATLASSIAN_KEY = ' *my atlassian key here* '
SOCIAL_AUTH_ATLASSIAN_KEY_SECRET = ' *my atlassian secret key here* '
LOGIN_URL = '/auth/login/atlassian-oauth2'
LOGIN_REDIRECT_URL = '/'
LOGOUT_REDIRECT_URL = '/'
SOCIAL_AUTH_URL_NAMESPACE = 'social'

SESSION_COOKIE_SECURE = False
# i had to do that^, based on what i have read from
# https://stackoverflow.com/questions/37617308/session-value-missing-after-redirect-with-django-python-social-auth
# but it still doesn't work, sadly...

然后这是我的登录页面的视图。

def index(request):
    session_id = request.session.session_key
    session_id = hashlib.sha256(str(session_id).encode('utf-8')).hexdigest()
    auth_url = 'https://auth.atlassian.com/authorize?audience=api.atlassian.com&client_id=*my_client_id_here*&scope=read%3Ajira-user%20read%3Ajira-work%20manage%3Ajira-project&redirect_uri=http%3A%2F%2Flocalhost%3A8000%2Fcomplete%2Fatlassian%2F&state=$'+ session_id +'&response_type=code&prompt=consent'
    print(auth_url)
    context = {
        'message': 'You are now authenticated'
        if request.user.is_authenticated else 'You are not authenticated',
        'auth_url': auth_url
    }
    return render(request, 'core/home.html', context)

解释一下下面的东西... 我之前用于授权的网址是..: <a href="{% url "social:begin" "* name of backend here *" %}"> 这是从文档中找到的 https:/python-social-auth-docs.readthedocs.ioenlatestconfigurationdjango.html。. 它的工作为Facebook和谷歌对我来说 - 但不与Atlassian。所以，我检查了指南的atlassian oauth2 (https:/developer.atlassian.comcloudjiraplatformoauth-2-授权码-赠款-3lo-for-apps。)，它说我必须使用的是 Jira平台休息API授权URL. 所以它为我工作。我能够访问它要求Atlassian用户授权的页面。 当我点击接受时，Django给我一个错误，说 "AuthStateMissing at completeatlassian"。回溯显示，它 raise AuthStateMissing(self, 'state'). 我从Atlassian指南中读到，我必须有一个状态是 "与你要引导到授权URL的用户相关联的值，例如，用户会话ID的哈希值"，所以我取了一个用户的cookie的哈希值，然后把它放到auth_url上--但还是不行。这是请求信息。 这是终端的信息

[15/May/2019 02:36:13] "GET /home/ HTTP/1.1" 200 1008
Internal Server Error: /complete/atlassian/
Traceback (most recent call last):
  File "/home/vasiliy/.virtualenvs/dj_atlassian/lib/python3.7/site-packages/django/core/handlers/exception.py", line 34, in inner
    response = get_response(request)
  File "/home/vasiliy/.virtualenvs/dj_atlassian/lib/python3.7/site-packages/django/core/handlers/base.py", line 115, in _get_response
    response = self.process_exception_by_middleware(e, request)
  File "/home/vasiliy/.virtualenvs/dj_atlassian/lib/python3.7/site-packages/django/core/handlers/base.py", line 113, in _get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
  File "/home/vasiliy/.virtualenvs/dj_atlassian/lib/python3.7/site-packages/django/views/decorators/cache.py", line 44, in _wrapped_view_func
    response = view_func(request, *args, **kwargs)
  File "/home/vasiliy/.virtualenvs/dj_atlassian/lib/python3.7/site-packages/django/views/decorators/csrf.py", line 54, in wrapped_view
    return view_func(*args, **kwargs)
  File "/home/vasiliy/.virtualenvs/dj_atlassian/lib/python3.7/site-packages/social_django/utils.py", line 49, in wrapper
    return func(request, backend, *args, **kwargs)
  File "/home/vasiliy/.virtualenvs/dj_atlassian/lib/python3.7/site-packages/social_django/views.py", line 33, in complete
    *args, **kwargs)
  File "/home/vasiliy/.virtualenvs/dj_atlassian/lib/python3.7/site-packages/social_core/actions.py", line 43, in do_complete
    user = backend.complete(user=user, *args, **kwargs)
  File "/home/vasiliy/.virtualenvs/dj_atlassian/lib/python3.7/site-packages/social_core/backends/base.py", line 40, in complete
    return self.auth_complete(*args, **kwargs)
  File "/home/vasiliy/.virtualenvs/dj_atlassian/lib/python3.7/site-packages/social_core/utils.py", line 259, in wrapper
    return func(*args, **kwargs)
  File "/home/vasiliy/.virtualenvs/dj_atlassian/lib/python3.7/site-packages/social_core/backends/oauth.py", line 388, in auth_complete
    state = self.validate_state()
  File "/home/vasiliy/.virtualenvs/dj_atlassian/lib/python3.7/site-packages/social_core/backends/oauth.py", line 90, in validate_state
    raise AuthStateMissing(self, 'state')
social_core.exceptions.AuthStateMissing: Session value state missing.

真的希望你们能帮忙，谢谢

Answer 1

在我的settings.py文件中。

SOCIAL_AUTH_REDIRECT_IS_HTTPS = True

我的生产服务器使用nginx将HTTP重定向到HTTPS，这就是会话状态丢失的原因。祝你好运--希望这能帮助你