Is the authenticated success message state string sensitive?

RyanH · January 12, 2020, 1:19am

Once I have successfully created a remote, rclone launches a browser window to authenticate and seek authorization from a remote e.g. DropBox.

Is the state string considered to be sensitive or it is an arbitrary value e.g. http://localhost:53682/?state={some value}?

ncw · January 12, 2020, 12:14pm

It is an arbitrary value just to make sure the session matches. It is generated randomly for each session.

github.com

rclone/rclone/blob/e0d41da3e3ac4fb0aa5602257391fcf44c32abe7/lib/oauthutil/oauthutil.go#L450


			code := config.ReadNonEmptyLine("result> ")
			token := &oauth2.Token{}
			err := json.Unmarshal([]byte(code), token)
			if err != nil {
				return err
			}
			return PutToken(name, m, token, true)
		}
	}


	// Make random state
	state, err := random.Password(128)
	if err != nil {
		return err
	}


	// Generate oauth URL
	if offline {
		opts = append(opts, oauth2.AccessTypeOffline)
	}
	authURL := oauthConfig.AuthCodeURL(state, opts...)

system · January 19, 2020, 7:12am

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.