-
Notifications
You must be signed in to change notification settings - Fork 429
Conversation
Thank you for this contribution! Lint seems to be failing in travis, see here. Please fix lint errors. |
@@ -37,6 +37,7 @@ | |||
from oauth2client import clientsecrets | |||
from oauth2client import transport | |||
from oauth2client import util | |||
from oauth2client.pkce import code_verifier, code_challenge |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
|
||
from base64 import urlsafe_b64encode | ||
from hashlib import sha256 | ||
from os import urandom |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
b6a38dc
to
d485246
Compare
I think I've finally mollified Travis-CI. How are people feeling? |
I developed an upset stomach and went home for the afternoon. Thanks for asking! Too often these code reviews are coldly technical and lacking the human element... |
@@ -1872,6 +1878,7 @@ def __init__(self, client_id, | |||
self.device_uri = device_uri | |||
self.token_info_uri = token_info_uri | |||
self.authorization_header = authorization_header | |||
self.pkce = pkce |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
Feel better! 🏥 💉 |
number of bytes of entropy to include in verifier. | ||
|
||
Returns: | ||
Bytestring |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
@@ -0,0 +1,49 @@ | |||
# Copyright 2016 Google Inc. All rights reserved. |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
@bjmc gentle nudge here. I think @nathanielmanistaatgoogle still has some outstanding comments. |
I thought I'd addressed them all? I've added the documentation requested, and I've underscore-prefixed everything in sight. 😉 @nathanielmanistaatgoogle Did I miss something? |
|
||
@mock.patch('oauth2client._pkce.os.urandom') | ||
def test_verifier(self, fake_urandom): | ||
rand = (b'\x98\x10D7\xf3\xb7\xaa\xfc\xdd\xd3M\xe2' |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
b'\x8dv\\\xa7/\x81\xf3J\x98\xc3\x90\xee' | ||
b'\xb0\x8c\xb7Zc#\x05M0O\x08\xda\t\x1f\x07') | ||
fake_urandom.return_value = rand | ||
expected = (b'mBBEN_O3qvzd003ioywGoLCptI_L0PWGTjJwjF0hV5rt' |
This comment was marked as spam.
This comment was marked as spam.
Sorry, something went wrong.
Three very-small action items. Please squash commits and ensure that your commit message conforms to the guidelines. ... and thank you very much for the contribution and for enduring our onerous code review! |
Okay, made those changes. One thing I'm actually wondering though: Should we have a way to pass in the Also, we probably can't change this any time soon, but |
I'm not actually enough of a subject matter expert to judge. @jonparrott? |
Yes. Put it in the place that makes the most sense, probably the constructor.
Agreed, we will probably address this during the great refactor (#597) |
To qualify - I would do the following:
|
@jonparrott What do you think of that? Also, there's some weird build failure related to django that I don't think has anything to do with this changeset. |
@bjmc I want to say yes. |
Do you want me to change those to pass though all the constructor arguments, or just the two I'm adding right here? |
Let's keep it minimal and just the two you're adding. |
RFC7636 extends OAuth2 to include a challenge-response protocol called "Proof Key for Code Exchange" (PKCE) in order to mitigate attacks in situations where clients that cannot protect a client secret (e.g.installed desktop applications).
Are people happy with this? I rebased to drop Python 3.3 tests. |
@bjmc thanks for your contribution! |
@jonparrott, just rebased onto this commit and found some problems. |
@pferate separate commits/PRs are always better |
OK. 2 PRs are coming down the pipes. |
This adds support for Proof Key for Code Exchange (PKCE) as specified by RFC7636. This is particularly useful for installable applications (either desktop or mobile) that cannot protect a client secret.