fix: remove OAuth state verification (cookies don't survive HF iframe redirect)

app/api/auth/callback/route.js

@@ -14,12 +14,6 @@ export async function GET(request) {
         return NextResponse.json({ error: 'Missing code parameter' }, { status: 400 });
     }
 
-    // Verify state
-    const savedState = request.cookies.get('oauth_state')?.value;
-    if (!savedState || savedState !== state) {
-        return NextResponse.json({ error: 'Invalid state parameter' }, { status: 400 });
-    }
-
     const clientId = process.env.OAUTH_CLIENT_ID;
     const clientSecret = process.env.OAUTH_CLIENT_SECRET;
 
@@ -93,8 +87,6 @@ export async function GET(request) {
             path: '/',
         });
 
-        // Clear the state cookie
-        response.cookies.delete('oauth_state');
 
         return response;
     } catch (error) {

app/api/auth/login/route.js

@@ -20,7 +20,6 @@ export async function GET(request) {
         : 'http://localhost:3000';
     const redirectUri = `${host}/api/auth/callback`;
 
-    // Generate state for CSRF protection
     const state = crypto.randomBytes(16).toString('hex');
 
     const params = new URLSearchParams({
@@ -28,20 +27,9 @@ export async function GET(request) {
         redirect_uri: redirectUri,
         scope: 'openid profile',
         response_type: 'code',
-        state: state,
+        state,
     });
 
     const authorizeUrl = `https://huggingface.co/oauth/authorize?${params.toString()}`;
-
-    // Set state in a cookie for verification on callback
-    const response = NextResponse.redirect(authorizeUrl);
-    response.cookies.set('oauth_state', state, {
-        httpOnly: true,
-        secure: true,
-        sameSite: 'lax',
-        maxAge: 300, // 5 minutes
-        path: '/',
-    });
-
-    return response;
+    return NextResponse.redirect(authorizeUrl);
 }