{"action":"created","issue":{"url":"https://api.github.com/repos/pac4j/play-pac4j/issues/66","labels_url":"https://api.github.com/repos/pac4j/play-pac4j/issues/66/labels{/name}","comments_url":"https://api.github.com/repos/pac4j/play-pac4j/issues/66/comments","events_url":"https://api.github.com/repos/pac4j/play-pac4j/issues/66/events","html_url":"https://github.com/pac4j/play-pac4j/issues/66","id":92132003,"number":66,"title":"Missing state parameter","user":{"login":"KentaKomai","id":1155967,"avatar_url":"https://avatars.githubusercontent.com/u/1155967?v=3","gravatar_id":"","url":"https://api.github.com/users/KentaKomai","html_url":"https://github.com/KentaKomai","followers_url":"https://api.github.com/users/KentaKomai/followers","following_url":"https://api.github.com/users/KentaKomai/following{/other_user}","gists_url":"https://api.github.com/users/KentaKomai/gists{/gist_id}","starred_url":"https://api.github.com/users/KentaKomai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/KentaKomai/subscriptions","organizations_url":"https://api.github.com/users/KentaKomai/orgs","repos_url":"https://api.github.com/users/KentaKomai/repos","events_url":"https://api.github.com/users/KentaKomai/events{/privacy}","received_events_url":"https://api.github.com/users/KentaKomai/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-06-30T16:01:35Z","updated_at":"2015-08-05T08:35:35Z","closed_at":null,"body":"First thanks for creating pac4j. It is  very useful libraries.\r\n\r\nI use `\"org.pac4j\" % \"play-pac4j_scala2.11\" % \"1.4.0\"` and `\"org.pac4j\" % \"pac4j-oauth\" % \"1.7.0\"` on Play framework 2.3.\r\n\r\nI am trying to implement a Facebook login in my web application.\r\nHowever, errors such as the following: I have out.\r\n\r\n```\r\nplay.api.Application$$anon$1: Execution exception[[OAuthCredentialsException: Missing state parameter : session expired or possible threat of cross-site request forgery]]\r\n\r\nat play.api.Application$class.handleError(Application.scala:296) ~[play_2.11-2.3.8.jar:2.3.8]\r\n\tat play.api.DefaultApplication.handleError(Application.scala:402) [play_2.11-2.3.8.jar:2.3.8]\r\n\tat play.core.server.netty.PlayDefaultUpstreamHandler$$anonfun$3$$anonfun$applyOrElse$4.apply(PlayDefaultUpstreamHandler.scala:320) [play_2.11-2.3.8.jar:2.3.8]\r\n\tat play.core.server.netty.PlayDefaultUpstreamHandler$$anonfun$3$$anonfun$applyOrElse$4.apply(PlayDefaultUpstreamHandler.scala:320) [play_2.11-2.3.8.jar:2.3.8]\r\n\tat scala.Option.map(Option.scala:146) [scala-library-2.11.6.jar:na]\r\nCaused by: org.pac4j.oauth.client.exception.OAuthCredentialsException: Missing state parameter : session expired or possible threat of cross-site request forgery\r\n\tat org.pac4j.oauth.client.BaseOAuth20Client.getOAuthCredentials(BaseOAuth20Client.java:86) ~[pac4j-oauth-1.7.0.jar:na]\r\n\tat org.pac4j.oauth.client.BaseOAuthClient.retrieveCredentials(BaseOAuthClient.java:128) ~[pac4j-oauth-1.7.0.jar:na]\r\n\tat org.pac4j.oauth.client.BaseOAuthClient.retrieveCredentials(BaseOAuthClient.java:45) ~[pac4j-oauth-1.7.0.jar:na]\r\n\tat org.pac4j.core.client.BaseClient.getCredentials(BaseClient.java:220) ~[pac4j-core-1.7.0.jar:na]\r\n\tat org.pac4j.play.java.RequiresAuthenticationAction$6.apply(RequiresAuthenticationAction.java:202) ~[play-pac4j_java-1.4.0.jar:na]\r\n```\r\n\r\nThis error will appear after it has approved the application on Facebook.\r\nWhen I get an error, URL is as follows:\r\n\r\n```\r\n/oauth/callback?\r\nclient_name=FacebookClient\r\n&code=[random string]\r\nstate=Pw2EftzrLD#_=_\r\n```\r\n\r\nWill you have a setting not something well?\r\nIt is operating normally in Twitter\r\n\r\nThank you."},"comment":{"url":"https://api.github.com/repos/pac4j/play-pac4j/issues/comments/127915074","html_url":"https://github.com/pac4j/play-pac4j/issues/66#issuecomment-127915074","issue_url":"https://api.github.com/repos/pac4j/play-pac4j/issues/66","id":127915074,"user":{"login":"leleuj","id":1038508,"avatar_url":"https://avatars.githubusercontent.com/u/1038508?v=3","gravatar_id":"","url":"https://api.github.com/users/leleuj","html_url":"https://github.com/leleuj","followers_url":"https://api.github.com/users/leleuj/followers","following_url":"https://api.github.com/users/leleuj/following{/other_user}","gists_url":"https://api.github.com/users/leleuj/gists{/gist_id}","starred_url":"https://api.github.com/users/leleuj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leleuj/subscriptions","organizations_url":"https://api.github.com/users/leleuj/orgs","repos_url":"https://api.github.com/users/leleuj/repos","events_url":"https://api.github.com/users/leleuj/events{/privacy}","received_events_url":"https://api.github.com/users/leleuj/received_events","type":"User","site_admin":false},"created_at":"2015-08-05T08:35:35Z","updated_at":"2015-08-05T08:35:35Z","body":"Indeed, nothing goes into the session except an identifier, everything else (tokens, states, profiles) goes into the Cache (using the StorageHelper class). As the session is held in a cookie (in all HTTP requests, limited to 4K), it's a good practice to only store the identifier in the session and other things in the Cache.\r\n\r\nThat said, it should work with the Cache and it works in the demo: https://github.com/pac4j/play-pac4j-java-demo & https://github.com/pac4j/play-pac4j-scala-demo\r\n\r\nI'm working on a rebuild of the library based on the new pac4j version 1.8: it's the perfect time for suggestions and contributions."}}