Crates.io: github Failed to log in: invalid state parameter

[cg-cnu]

As mentioned in #1077

on registering and login in its throwing an error...
Failed to log in: invalid state parameter
Tried revoking the access and loging in from incognito. No success.
Let me know if I can help in debugging it.
Btw, am on on mac sierra with chrome.

[carols10cents]

Hi @cg-cnu, sorry you're running into this and sorry I haven't gotten back to you!

Is this still happening? Could you try clearing your cookies for crates.io and see if that changes anything?

How much debugging are you willing to do? :) Could you try setting up a local instance of crates.io and a GitHub oAuth application and see if the same problem happens with you when signing into your locally running instance? There are instructions for setting up a development environment here: https://github.com/rust-lang/crates.io/blob/master/docs/CONTRIBUTING.md#setting-up-a-development-environment and instructions on setting up GitHub integration in this section: https://github.com/rust-lang/crates.io/blob/master/docs/CONTRIBUTING.md#publishing-a-crate-to-your-local-cratesio

Some background/guesses/things I'm thinking about:

I'm not really sure if this is a crates.io problem, a github problem, a network problem, something else-- this error message comes from this spot because the state parameter (generated here and sent to github) returned from github is not matching the state parameter we saved in the current session. Some things I'd like to know if you're able to reproduce this with a locally running instance:

• Are both Some(&state[..]) and session_state non-empty strings?
• Are there any special characters in either of the state values that are being encoded incorrectly?
• Or are they both random looking, very different strings? If this is the case, I'm not sure where to go from there :-/

[cg-cnu]

Hey @carols10cents
Thanks for the detailed explanation. I would setup the environment and do the debugging over the weekend. I will get back to you if I have any questions. Thanks 😄

[ChristopherMacGown]

I can also reproduce this on the public site. However, I wasn't able to reproduce it locally against the rust-lang/crates.io master branch with either Safari or Chrome (11.0.2 and 63.0.3239.132 respectively). The logs suggest that the parameters GitHub is returning are correct.

[nghenglim]

Same here, unable to login to crates.io. In the chrome dev tools:

Request URL:https://github.com/login/oauth/authorize?client_id=MY_CLIENT_ID&state=MY_STATE&scope=read%3Aorg
Request Method:GET
Status Code:302 Found
Remote Address:192.30.255.112:443
Referrer Policy:no-referrer-when-downgrade

Request URL: https://crates.io/authorize/github?code=MY_CODE&state=MY_STATE
Request Method:GET
Status Code:200 OK
Remote Address:23.23.136.239:443
Referrer Policy:no-referrer-when-downgrade



md5-f09e0be6c92a8454d142d7db427e9ce9



Request URL:https://crates.io/authorize?code=MY_CODE&state=MY_STATE
Request Method:GET
Status Code:404 Not Found
Remote Address:23.23.136.239:443
Referrer Policy:no-referrer-when-downgrade

[nghenglim]

Okay found out the problem! Looking at the code I figured out only name / email field which crates.io get from github could be wrong.

In github I actually set my public email to NA (because I don't want people to see my actual email there. To check out whether is email caused the problem I set it to my actual verified email and try login! then success!

However I don't think crates.io should be using our public github email as a reference field (and somemore tries to send verification email to it!)

tl;dr: Just change github email to true email then it fixed the problem.

[genbattle]

Adding my +1 to this issue. Strangely I seem to have my email publicly displayed, so I'm not sure exactly why I'm getting this error when trying to log into crates.io. I've never successfully logged into crates.io before.

[genbattle]

Editing my profile in Github (even though I don't think I changed anything) seems to have solved the issue for me? Possibly there's some sort of grandfathering or backend migration that kicked in when I re-saved my profile.

[prewk]

I tried editing the profile as suggested by @genbattle but to no avail. Still getting the error.

[prewk]

Suddenly works now!

[cg-cnu]

Looks like this is fixed. I can also confirm that this is working as expected.
Closing the issue 🙂

[oli-obk]

I just ran into the same problem, and it ended up being Ghostery (tracking blocking) which broke the login. Disabling Ghostery for crates.io solves the problem

[Roger]

I'm having the same issue with firefox/chrome disabling extensions in both

[cbiffle]

This is still very much an issue -- crates.io fails with the "invalid state parameter" message for me unless I put a public email address up. If this is a requirement, y'all should at least improve the error message.

[carols10cents]

@cbiffle it is not a requirement. We've actually merged a fix for this, we just need to deploy it. Thank you for your patience!

[AurevoirXavier]

Still got this in 2020.