fix: accidental unnecessarily strict conditional that effectively rendered SSO state checking opt-in instead of opt-out

This commit is contained in:
Julian Lam
2021-06-14 14:13:31 -04:00
parent 520050da19
commit a2400f6baf

View File

@@ -104,7 +104,7 @@ Auth.reloadRoutes = async function (params) {
prompt: strategy.prompt || undefined,
};
if (strategy.checkState) {
if (strategy.checkState !== false) {
req.session.ssoState = req.csrfToken && req.csrfToken();
opts.state = req.session.ssoState;
}