I've added apple-id to a django project that already has facebook & twitter login implemented & working.

From the application you can get to apple, login and then you come back to the /player/social/complete/{backend}/ path. Here there's an AuthStateMissing: Session value state missing exception.

Sessions are using signed_cookies, SESSION_COOKIE_SAMESITE is currently "Lax" but I've tried to set that to None with no change.

Besides the client/team/key settings I have also defined the following for Apple ID

SOCIAL_AUTH_APPLE_ID_SCOPE = ["email", "name"]
SOCIAL_AUTH_APPLE_ID_EMAIL_AS_USERNAME = (
    True  # If you want to use email as username
)

I've tried various bits that I've found suggested on here and github issues, like specifying the state field for session storage. But nothing seems to resolve this issue and I'm not familiar enough with how this library works - I'd hoped it'd "just work" like apple usually suggest!

For clarity here's the settings I've tried, none of which change the outcome.

In [1]: from django.conf import settings

In [2]: settings.SOCIAL_AUTH_REDIRECT_IS_HTTPS
Out[2]: True

In [3]: settings.SOCIAL_AUTH_FIELDS_STORED_IN_SESSION
Out[3]: ['state']

In [4]: settings.SESSION_COOKIE_SECURE
Out[4]: False

In [5]: settings.SESSION_ENGINE
Out[5]: 'django.contrib.sessions.backends.signed_cookies'

And from sentry I can see that in do_complete() I've got;

data = {
    code: "ce37e855726d1438c8a17c4bbe271b14f.0.rtxw.TA3pbBjAnNOHmNWy98BVqA",
    state: "HXThIRc2ZVFiysClAMyNhgcWKfuoPr4e"
}

But I don't know what/where that state value is supposed to be set to the session or where to look for an issue getting it back out.

I've added apple-id to a django project that already has facebook & twitter login implemented & working.

From the application you can get to apple, login and then you come back to the /player/social/complete/{backend}/ path. Here there's an AuthStateMissing: Session value state missing exception.

Sessions are using signed_cookies, SESSION_COOKIE_SAMESITE is currently "Lax" but I've tried to set that to None with no change.

Besides the client/team/key settings I have also defined the following for Apple ID

SOCIAL_AUTH_APPLE_ID_SCOPE = ["email", "name"]
SOCIAL_AUTH_APPLE_ID_EMAIL_AS_USERNAME = (
    True  # If you want to use email as username
)

I've tried various bits that I've found suggested on here and github issues, like specifying the state field for session storage. But nothing seems to resolve this issue and I'm not familiar enough with how this library works - I'd hoped it'd "just work" like apple usually suggest!

For clarity here's the settings I've tried, none of which change the outcome.

In [1]: from django.conf import settings

In [2]: settings.SOCIAL_AUTH_REDIRECT_IS_HTTPS
Out[2]: True

In [3]: settings.SOCIAL_AUTH_FIELDS_STORED_IN_SESSION
Out[3]: ['state']

In [4]: settings.SESSION_COOKIE_SECURE
Out[4]: False

In [5]: settings.SESSION_ENGINE
Out[5]: 'django.contrib.sessions.backends.signed_cookies'

And from sentry I can see that in do_complete() I've got;

data = {
    code: "ce37e855726d1438c8a17c4bbe271b14f.0.rtxw.TA3pbBjAnNOHmNWy98BVqA",
    state: "HXThIRc2ZVFiysClAMyNhgcWKfuoPr4e"
}

But I don't know what/where that state value is supposed to be set to the session or where to look for an issue getting it back out.

• django
• python-social-auth

Share Improve this question Follow edited Nov 20, 2024 at 2:45 markwalker_ asked Nov 19, 2024 at 12:00 markwalker_markwalker_ 12.9k77 gold badges6767 silver badges105105 bronze badges 2

• have you double checked the apple developer credentials plus callback url is defined there? – ogcPYTHON Commented Nov 19, 2024 at 12:18
• @ogcPYTHON I don't actually have access to the apple side, but I'm told it's all correct & the keys & secrets in the app are all correct. I assumed if the callback URLs weren't defined in there then I'd see a different error, like a redirect uri error – markwalker_ Commented Nov 19, 2024 at 13:53

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

Try adding following variables in settings.py

SOCIAL_AUTH_REDIRECT_IS_HTTPS = True

You can try this too if the issue still persists

SOCIAL_AUTH_FIELDS_STORED_IN_SESSION = ['state']
SESSION_COOKIE_SECURE = False