Paw Oauth2 Implicit Grant Flow: Invalid State in authorization response

Question

I have setup an authenticated endpoint that requires Slack signin via Oauth2. I have a web front-end that works great -- I can authenticate via Slack and get a token from my callback method (via JSON in the response).

If I try to implement the same flow in Paw, I see an error, "Invalid State in authorization response". From my server logs, I can see that the callback url is being hit and that the JSON is being returned, but Paw errors out and I can't inspect the response.

I'm trying to capture the JWT via "Response Parsed Body -> JSON"

Here is the paw print: https://paw.pt/ewvrJX0L

NOTE: Authorization Grant flow doesn't work either.

Answer 1

It's likely that the server is not returning a state parameter as expected by the OAuth 2 spec. Some servers do not and most client libraries are deliberately accepting the response nevertheless.

Paw can ignore the state parameter and accept the server response if you uncheck the box "Strict Mode: Perform additional checks on the response".

This should help solve the problem in your case.