lib/response.js

@@ -65,14 +65,19 @@ function githubActions (req, res, next) {
 function githubActionGist (req, res, note) {
   const code = req.query.code
   const state = req.query.state
-  if (!code || !state) {
+  const sessionsState = req.session.githubGistState
+  const redirectUri = req.session.githubGistRedirectUri
+  delete req.session.githubGistState
+  delete req.session.githubGistRedirectUri
+  if (!code || !state || sessionsState !== state) {
     return errors.errorForbidden(res)
-  } else {
+  }
+
   const data = {
     client_id: config.github.clientID,
     client_secret: config.github.clientSecret,
     code,
-      state
+    redirect_uri: redirectUri
   }
   const authUrl = 'https://github.com/login/oauth/access_token'
   fetch(authUrl, {
@@ -128,7 +133,6 @@ function githubActionGist (req, res, note) {
     return errors.errorInternalError(res)
   })
 }
-}
 
 function gitlabActions (req, res, next) {
   const noteId = req.params.noteId

lib/web/note/actions.js

@@ -32,11 +32,15 @@ exports.getInfo = function getInfo (req, res, note) {
 }
 
 exports.createGist = function createGist (req, res, note) {
+  const state = nanoid.nanoid()
+  const redirectUri = config.serverURL + '/auth/github/callback/' + models.Note.encodeNoteId(note.id) + '/gist'
+  req.session.githubGistState = state
+  req.session.githubGistRedirectUri = redirectUri
   const data = {
     client_id: config.github.clientID,
-    redirect_uri: config.serverURL + '/auth/github/callback/' + models.Note.encodeNoteId(note.id) + '/gist',
+    redirect_uri: redirectUri,
     scope: 'gist',
-    state: nanoid.nanoid()
+    state
   }
   const query = querystring.stringify(data)
   res.redirect('https://github.com/login/oauth/authorize?' + query)