changeset

Removes the state parameter that contains auth nonce and the associated logic.

The state parameter which contains the auth nonce in the auth callback doesn't work with multi-windows as each window contains its own nonce. As the provider parameter is sufficient to identify the auth provider we could remove the auth nonce to avoid complications.

.changeset/twenty-snails-explode.md

@@ -0,0 +1,5 @@
+---
+"claude-dev": patch
+---
+
+Remove state parameter from auth callback link that allows redirect to work when multiple windows are opened

src/core/controller/index.ts

@@ -461,11 +461,6 @@ export class Controller {
 		}
 	}
 
-	// Auth
-	public async validateAuthState(state: string | null): Promise<boolean> {
-		return state === this.authService.authNonce
-	}
-
 	async handleAuthCallback(customToken: string, provider: string | null = null) {
 		try {
 			await this.authService.handleAuthCallback(customToken, provider ? provider : "google")

src/extension.ts

@@ -301,35 +301,12 @@ export async function activate(context: vscode.ExtensionContext) {
 				break
 			}
 			case "/auth": {
-				const authService = AuthService.getInstance()
 				console.log("Auth callback received:", uri.toString())
 
 				const token = query.get("idToken")
-				const state = query.get("state")
 				const provider = query.get("provider")
 
-				console.log("Auth callback received:", {
-					token: token,
-					state: state,
-					provider: provider,
-				})
-
-				// Ask user to confirm on state mismatch. This enables signins initiated from
-				// outside the extension (e.g. Cline web) to be handled correctly.
-				if (authService.authNonce !== state) {
-					const userConfirmation = (
-						await getHostBridgeProvider().windowClient.showMessage(
-							ShowMessageRequest.create({
-								type: ShowMessageType.ERROR,
-								message: "Invalid auth state",
-							}),
-						)
-					)?.selectedOption
-					if (userConfirmation === "Cancel") {
-						console.log("User declined to continue with auth callback due to state mismatch")
-						return
-					}
-				}
+				console.log("Auth callback received:", { provider })
 
 				if (token) {
 					await visibleWebview?.controller.handleAuthCallback(token, provider)

src/services/auth/AuthService.ts

@@ -1,5 +1,4 @@
 import vscode from "vscode"
-import crypto from "crypto"
 import { EmptyRequest, String } from "../../shared/proto/common"
 import { AuthState, UserInfo } from "../../shared/proto/account"
 import { StreamingResponseHandler, getRequestRegistry } from "@/core/controller/grpc-handler"
@@ -51,7 +50,6 @@ export class AuthService {
 	private _authenticated: boolean = false
 	private _clineAuthInfo: ClineAuthInfo | null = null
 	private _provider: { provider: FirebaseAuthProvider } | null = null
-	private readonly _authNonce = crypto.randomBytes(32).toString("hex")
 	private _activeAuthStatusUpdateSubscriptions = new Set<[Controller, StreamingResponseHandler]>()
 	private _context: vscode.ExtensionContext
 
@@ -158,10 +156,6 @@ export class AuthService {
 		this._setProvider(providerName)
 	}
 
-	get authNonce(): string {
-		return this._authNonce
-	}
-
 	async getAuthToken(): Promise<string | null> {
 		if (!this._clineAuthInfo) {
 			return null
@@ -220,7 +214,6 @@ export class AuthService {
 
 		// Use URL object for more graceful query construction
 		const authUrl = new URL(this._config.URI)
-		authUrl.searchParams.set("state", this._authNonce)
 		authUrl.searchParams.set("callback_url", callbackUrl)
 
 		const authUrlString = authUrl.toString()