Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.
Sign upAdd option for forcing https. #53
Merged
Conversation
This comment has been minimized.
This comment has been minimized.
peny
commented
Feb 2, 2015
|
+1 |
lib/oauth.js
Outdated
| @@ -135,6 +135,10 @@ exports.v2 = function (settings) { | |||
| return reply(Boom.internal('App was rejected')); | |||
| } | |||
|
|
|||
| // Alter the request to be able to force HTTPS. | |||
| if (settings.forceHttps) { | |||
| request.connection.info.protocol = 'https'; | |||
This comment has been minimized.
This comment has been minimized.
geek
Feb 2, 2015
Member
Instead, we should pass a new parameter to location(request) for protocol. Otherwise we are overwriting request connection information that may not always be safe.
This comment has been minimized.
This comment has been minimized.
|
Added a new commit that passes the protocol to the location function instead (as suggested in the diff comment. And by myself - for that matter :)) |
This comment has been minimized.
This comment has been minimized.
|
@eiriksm thanks for the help, looks good. I'll publish soon |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
eiriksm commentedJan 17, 2015
As mentioned in #40, this is a PR adding the option to force https in redirect_uri.
Granted, it might not be the best solution to alter the request object like this, but this certainly works. The other option would be to pass in the settings as a parameter to the location function, not sure which one you prefer? IMO the naming of the option (force) indicates some force, and thus we are forcing the request object to be https :)
PR also adds a test for this.