From 88c0c4a453af60bbbafa718af3dcd856c58ac831 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 24 Aug 2026 04:12:34 +0000
Subject: [PATCH] Fix Authelia OIDC state check and hide redirect URI on login

Auth.js OIDC defaults to PKCE-only, so no `state` was sent; Authelia
rejects that. Enable checks: pkce + state. Remove the public redirect
URI hint from the login page.
---
 src/app/login/page.tsx             |  6 ------
 src/components/LoginPageClient.tsx | 26 ++++++++------------------
 src/lib/auth/auth.ts               |  2 ++
 3 files changed, 10 insertions(+), 24 deletions(-)

diff --git a/src/app/login/page.tsx b/src/app/login/page.tsx
index 1f5b82b..63f20fe 100644
--- a/src/app/login/page.tsx
+++ b/src/app/login/page.tsx
@@ -6,16 +6,10 @@ import { LoginPageClient } from "@/components/LoginPageClient";
 export const dynamic = "force-dynamic";
 
 export default function LoginPage() {
-  const authUrl = (process.env.AUTH_URL || "").replace(/\/$/, "");
-  const callbackUrlHint = authUrl
-    ? `${authUrl}/api/auth/callback/oidc`
-    : "https://<your-host>/api/auth/callback/oidc";
-
   return (
     <LoginPageClient
       oidcEnabled={isOidcConfigured()}
       oidcName={process.env.AUTH_OIDC_NAME || "SSO"}
-      callbackUrlHint={callbackUrlHint}
     />
   );
 }
diff --git a/src/components/LoginPageClient.tsx b/src/components/LoginPageClient.tsx
index 68e28f4..888cf72 100644
--- a/src/components/LoginPageClient.tsx
+++ b/src/components/LoginPageClient.tsx
@@ -8,13 +8,11 @@ import { Suspense } from "react";
 type Props = {
   oidcEnabled: boolean;
   oidcName: string;
-  callbackUrlHint: string;
 };
 
 type AuthConfig = {
   oidcEnabled: boolean;
   oidcName: string;
-  callbackUrl: string;
 };
 
 function authErrorMessage(code: string | null): string | null {
@@ -36,7 +34,7 @@ function authErrorMessage(code: string | null): string | null {
   }
 }
 
-function LoginForm({ oidcEnabled, oidcName, callbackUrlHint }: Props) {
+function LoginForm({ oidcEnabled, oidcName }: Props) {
   const router = useRouter();
   const params = useSearchParams();
   const callbackUrl = params.get("callbackUrl") || "/";
@@ -62,7 +60,6 @@ function LoginForm({ oidcEnabled, oidcName, callbackUrlHint }: Props) {
 
   const showOidc = runtimeOidc?.oidcEnabled ?? oidcEnabled;
   const displayName = runtimeOidc?.oidcName || oidcName;
-  const redirectHint = runtimeOidc?.callbackUrl || callbackUrlHint;
 
   async function onSubmit(e: FormEvent) {
     e.preventDefault();
@@ -121,20 +118,13 @@ function LoginForm({ oidcEnabled, oidcName, callbackUrlHint }: Props) {
           {loading ? "Signing in…" : "Sign in"}
         </button>
         {showOidc && (
-          <>
-            <button
-              type="button"
-              className="btn btn-secondary"
-              onClick={() => signIn("oidc", { callbackUrl })}
-            >
-              Sign in with {displayName}
-            </button>
-            <p className="muted" style={{ margin: 0, fontSize: "0.75rem" }}>
-              IdP redirect URI must be exactly:
-              <br />
-              <code className="mono">{redirectHint}</code>
-            </p>
-          </>
+          <button
+            type="button"
+            className="btn btn-secondary"
+            onClick={() => signIn("oidc", { callbackUrl })}
+          >
+            Sign in with {displayName}
+          </button>
         )}
       </form>
     </div>
diff --git a/src/lib/auth/auth.ts b/src/lib/auth/auth.ts
index e3e949b..f16a3ec 100644
--- a/src/lib/auth/auth.ts
+++ b/src/lib/auth/auth.ts
@@ -45,6 +45,8 @@ function buildProviders(): Provider[] {
       wellKnown: `${issuer}/.well-known/openid-configuration`,
       clientId: process.env.AUTH_OIDC_CLIENT_ID!,
       clientSecret: process.env.AUTH_OIDC_CLIENT_SECRET!,
+      // Auth.js OIDC defaults to PKCE-only; Authelia requires a strong `state`
+      checks: ["pkce", "state"],
       authorization: {
         params: {
           scope: "openid email profile",