I’m developing a nodejs application for login/consent flow using Hydra v1.4.2.
I’m able to complete step #3 in https://www.ory.sh/hydra/docs/oauth2/#authenticating-users-and-requesting-consent. Hydra is not redirecting to a URL mentioned in step #4
Sequence of API calls:
- GET https://35.194.72.53:9000/oauth2/auth?scope=offline_access&response_type=code&client_id=test&state=o1kh6qg4024&redirect_uri=http://localhost:3000/login
- GET http://localhost:3000/login?login_challenge=00f4ac944f0b44f49e08aed581e71b7d
- PUT https://35.194.72.53:9001/oauth2/auth/requests/login/accept?login_challenge=f19aa722927f4ded8f9c6743b5e7d1f6
PUT method returns below redirect_to URL
https://35.194.72.53:9000/oauth2/auth?client_id=test&login_verifier=83eb38b0ab0c4c418f8d5ed583ca954c&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Flogin&response_type=code&scope=offline_access&state=o1kh6qg4024
Redirecting to above URL using node-fetch causes
‘http://localhost:3000/login?error=request_forbidden&error_debug=CSRF+session+cookie+could+not+be+decoded&error_description=The+request+is+not+allowed&error_hint=You+are+not+allowed+to+perform+this+action.&state=o1kh6qg4024’,
Redirecting to above URL from browser causes
GET /login?error=invalid_request&error_debug=Authentication+verifier+has+been+used+already&error_description=The+request+is+missing+a+required+parameter%2C+includes+an+invalid+parameter+value%2C+includes+a+parameter+more+than+once%2C+or+is+otherwise+malformed&error_hint=Make+sure+that+the+various+parameters+are+correct%2C+be+aware+of+case+sensitivity+and+trim+your+parameters.+Make+sure+that+the+client+you+are+using+has+exactly+whitelisted+the+redirect_uri+you+specified.&state=o1kh6qg4024