You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
to build the authorization Url, which ist send as a redirect to the users browser, thus exposing the client_secret.
the client_secret should only be used in the token exchange, thus when the server makes the request to the provider, and not during authorization when the browser of the user does.
This is NOT a flaw in Leagues client, this is due to too many options being included when forming the url in the aforementioned lines of code.
The text was updated successfully, but these errors were encountered:
Thanks for the report and digging into this. Also sorry for it being 3 days before I saw this, I'm looking for other maintainers for this repo. Do you have a fix for this ready? If so I'd be more than willing to merge it and tag a release ASAP. Otherwise I'll try to get time to fix this as soon as I can find time.
In:
Auth/src/Oauth2/Client/ProviderManager.php
Line 167 in 2cddfab
the client_secret is put into the ProviderOptions, which is used here:
Auth/src/Oauth2/Handler/Remote.php
Line 184 in 2cddfab
Auth/src/Oauth2/Handler/Remote.php
Line 185 in 2cddfab
Auth/src/Oauth2/Handler/Remote.php
Line 186 in 2cddfab
to build the authorization Url, which ist send as a redirect to the users browser, thus exposing the client_secret.
the client_secret should only be used in the token exchange, thus when the server makes the request to the provider, and not during authorization when the browser of the user does.
This is NOT a flaw in Leagues client, this is due to too many options being included when forming the url in the aforementioned lines of code.
The text was updated successfully, but these errors were encountered: