mvl3h (mvl3h) asked a question.
Hi,
The user hits OIDC URL and clicks on Forgot Password and enters email id.
User receives a password reset link and resets the password.
GET /oauth2/ausjsllz6fb8chQZ14x6/v1/authorize?client_id=0oajsl0xfwoTRY4Ho4x6&nonce=ff1d962090a36451b98d268a728181e9&redirect_uri=https%3A%2F%2Flocalhost&response_type=code&scope=openid&state=ff1d962090a36451b98d268a728181e9 HTTP/1.1
Response HTTP/1.1 302 Found
GET /login/login.htm?fromURI=/oauth2/v1/authorize/redirect?okta_key=q2Ox_G_bV4q1shIrxqLbYhgI1fy8iugNXeOCJQ4C2Co HTTP/1.1
Once user completes forgot password flow, user is redirected to okta end user dashboard instead of actual redirect url (https://localhost)
/login/sessionCookieRedirect?checkAccountSetupComplete=true&token=20111xplUp9xlyKFPLB9P3uUR1g5z8y1aCY-YvoXaiDdMO_INv7ZEE_&redirectUrl=https%3A%2F%2Faon-asc.okta.com%2Fuser%2Fnotifications
GET
checkAccountSetupComplete: true
token: 20111xplUp9xlyKFPLB9P3uUR1g5z8y1aCY-YvoXaiDdMO_INv7ZEE_
redirectUrl: https://aon-asc.okta.com/user/notifications
I feel okta_key is failed to check in the database or lost to redirect the user to right redirect URL.
Is this a bug?. Do we have a workaround?
It looks like in your case the state token is not getting preserved when the password reset flow is being initiated, that being said please open a ticket with the Okta Customer Support team so we can troubleshoot this issue based on your feedback.