Search code examples
oauth-2.0google-oauthactions-on-google

the parameter " state " must be set in query string in result what should i do further

I did a smart home google action connection. web app to google home linked and authorized.

I followed the smart home google action. there needed the state. What is the state?

the given below string is an example to authorize but I do not know about state string

from where I add state string and what is the purpose of it?

GET https://myservice.example.com/auth?client_id=GOOGLE_CLIENT_ID&redirect_uri=REDIRECT_URI&state=STATE_STRING&response_type=token
Solution

  • You should get the state from the parameters that Google sends your auth endpoint in URL parameters.

    If you're using the implicit flow, those parameters are:

    • client_id - The client ID you assigned to Google.
    • redirect_uri - The URL to which you send the response to this request.
    • state - A bookkeeping value that is passed back to Google unchanged in the redirect URI.
    • response_type - The type of value to return in the response. For the OAuth 2.0 implicit flow, the response type is always "token".

    If you're using the auth code flow, you'll get similar parameters, but the value of response_type will be "code".

    You should send exactly the same value you get for state back as the state parameter in the URL you redirect to. This is part of the security of OAuth used to help prevent replay attacks and for the OAuth client to identify which request is being replied to.