State is currently bound to the browser via the sso_state cookie set on the login redirect. That works for single-host deployments but has known limits:
- Deployments serving login and callback from different hosts cannot carry the cookie, and their only option today is to disable state validation entirely.
_generated_state lives on the SSO instance, so it is tied to the context-manager lifecycle rather than to the individual login attempt.- The cookie is never cleared after a successful callback.
README already announces a pluggable server-side store (in-memory by default, with support for external stores such as Redis) for 1.0.0. Filing this to track it.
Related: #307.
State is currently bound to the browser via the
sso_statecookie set on the login redirect. That works for single-host deployments but has known limits:_generated_statelives on the SSO instance, so it is tied to the context-manager lifecycle rather than to the individual login attempt.README already announces a pluggable server-side store (in-memory by default, with support for external stores such as Redis) for
1.0.0. Filing this to track it.Related: #307.