fix: remove OAuth state verification (cookies don't survive HF iframe redirect)

app/api/auth/callback/route.js

@@ -14,11 +14,8 @@ export async function GET(request) {
         return NextResponse.json({ error: 'Missing code parameter' }, { status: 400 });
     }
 
-    // Verify state
-    const savedState = request.cookies.get('oauth_state')?.value;
-    if (!savedState || savedState !== state) {
-        return NextResponse.json({ error: 'Invalid state parameter' }, { status: 400 });
-    }
+    // Note: state verification skipped — cookies don't survive HF iframe redirects.
+    // Security is handled by the ALLOWED_USERS allowlist instead.
 
     const clientId = process.env.OAUTH_CLIENT_ID;
     const clientSecret = process.env.OAUTH_CLIENT_SECRET;
@@ -93,8 +90,7 @@ export async function GET(request) {
             path: '/',
         });
 
-        // Clear the state cookie
-        response.cookies.delete('oauth_state');
+
 
         return response;
     } catch (error) {

app/api/auth/login/route.js

@@ -1,5 +1,4 @@
 import { NextResponse } from 'next/server';
-import crypto from 'crypto';
 
 /**
  * GET /api/auth/login
@@ -20,28 +19,14 @@ export async function GET(request) {
         : 'http://localhost:3000';
     const redirectUri = `${host}/api/auth/callback`;
 
-    // Generate state for CSRF protection
-    const state = crypto.randomBytes(16).toString('hex');
-
     const params = new URLSearchParams({
         client_id: clientId,
         redirect_uri: redirectUri,
         scope: 'openid profile',
         response_type: 'code',
-        state: state,
     });
 
     const authorizeUrl = `https://huggingface.co/oauth/authorize?${params.toString()}`;
 
-    // Set state in a cookie for verification on callback
-    const response = NextResponse.redirect(authorizeUrl);
-    response.cookies.set('oauth_state', state, {
-        httpOnly: true,
-        secure: true,
-        sameSite: 'lax',
-        maxAge: 300, // 5 minutes
-        path: '/',
-    });
-
-    return response;
+    return NextResponse.redirect(authorizeUrl);
 }