Session issue when using Laravel Socialite X (Twitter) in stateless mode

[Kim-Munbeom]

Socialite Version

5.23.1

Laravel Version

12.35.1

PHP Version

8.4.14

Database Driver & Version

No response

Description

1. Issue Occurred

• Reason: The problem occurred because a stateless process, which shouldn't save state, was using sessions.
• Location of the Issue: vendor/laravel/socialite/src/Two/AbstractProvider.php@redirect()
• Lines: 169 ~ 171
• Code:

public function redirect()
{
    $state = null;

    if ($this->usesState()) {
        $this->request->session()->put('state', $state = $this->getState());
    }

    if ($this->usesPKCE()) {
        $this->request->session()->put('code_verifier', $this->getCodeVerifier());
    }

    return new RedirectResponse($this->getAuthUrl($state));
}

2. Cause

• Location: vendor/laravel/socialite/src/Two/TwitterProvider.php
• Line: 22
• Code:

protected $usesPKCE = true;

3. Solution

1. Provider Creation

<?php

namespace App\Services;

use Laravel\Socialite\Two\XProvider as BaseXProvider;

class CustomXProvider extends BaseXProvider
{
    /**
     * Forces the simplest **Stateless** mode by disabling PKCE usage,
     * which avoids the use of session-related logic.
     *
     * @var bool
     */
    protected $usesPKCE = false;
}

2. Provider Registration

$socialite = $this->app->make(SocialiteFactory::class);
// Extend the 'x' (or 'twitter') driver with the custom driver.
$socialite->extend(
    'x',
    function ($app) use ($socialite) {
        // Inject the 'x' configuration from config/services.php into the custom provider.
        $config = $app['config']['services.x'];

        // Create and return an instance of CustomXProvider.
        return $socialite->buildProvider(CustomXProvider::class, $config);
    }
);

3. Resolution

Steps To Reproduce

It occurs when installing according to the manual and using X's OAuth 2.0 in stateless mode.

[eamon-straughn]

I've got this issue with Azure in laravel 13