OAuth State Error for social providers since Supabase.Gotrue v6.1.0

[AndrewKahr]

Bug report

Describe the bug

Since Supabase.Gotrue v6.1.0, there has been an issue where logging into social providers like Google and Apple fails due to a state error. The returned url parameters are ?error=invalid_request&error_code=bad_oauth_state&error_description=OAuth+state+parameter+is+invalid. If you manually remove the state argument from the url before trying to perform the sign-in, it works. This was seemingly introduced in supabase-community/gotrue-csharp@2de994c where it now always generates and adds a state value. Looking in the referenced modeled after link in the documentaion for GetUrlForProvider, it doesn't look like the auth-js version of the function creates or adds the state to the URL, which is likely why the issue is only surfacing here.

To Reproduce

Use the gotrue client to get a ProviderAuthState from client.SignIn. Then perform PKCE sign-in with the generated URL and you get redirected with the error instead of successfully signing in.

Expected behavior

Successfully sign in with the PKCE flow with providers like Google and Apple.

System information

• OS: Windows
• Browser: Chrome (started from csharp in Unity)
• Version of supabase-csharp: 6.3.0

[Tr00d]

Thanks @AndrewKahr, I'll have a look asap

[Tr00d]

@AndrewKahr I've just release Gotrue 6.3.1 / Supabase 1.6.1, which do not send the state anymore.
Let me know how it goes

[AndrewKahr]

Hey @Tr00d, thanks for the quick turnaround on this! I tried to go test it, but it's now erroring out because it can't find Supabase.Core.Http.RetryOptions. I assume it's due to this commit: 74a72d0
Is there a Supabase Core version that needs to be bumped to make this all work? Or am I missing something on my end?

If a new release bump is required, can #391 be bundled with it to resolve LinkIdentity issues I've run into as well so an additional release is not needed? Thanks!