#6541 Fix Use of constant `state` value in OAuth 2.0 URL Pull request opened by odaysec flyte/flyteidl/clients/go/admin/pkce/auth_flow_orchestrator.go Line 61 in</flyteorg/flyte/commit/cfcea4dd8181e038bc4e4de2d0c0021b1eab02d9|cfcea4d> | urlToOpen := fmt.Sprintf("%s&%s", f.ClientConfig.AuthCodeURL(""), values.Encode()) | | ---------------------------------------------------------------------------------- | fix the issue, we need to ensure that a unique, non-guessable

state

value is passed to the

AuthCodeURL

function. This can be achieved by using the

stateString

generated on line 50. Additionally, the

stateString

should be validated in the callback handler to ensure the integrity of the OAuth flow. • Replace the empty string (

""

) in the

AuthCodeURL

function call on line 61 with the

stateString

variable. • Ensure that the

stateString

is validated in the callback handler to confirm that it matches the value sent in the initial request. ## Check all the applicable boxes • I updated the documentation accordingly. • All new and existing tests passed. • All commits are signed-off. ## Related PRs ## Docs link https://bito.ai#summarystart| ### Summary by Bito This pull request fixes a critical bug in the OAuth 2.0 implementation by ensuring a unique, non-guessable

state

value is used in the

AuthCodeURL

function. It also adds validation for the

stateString

in the callback handler to enhance the security and integrity of the authentication process. flyteorg/flyte