change: deprecate options.url, enforce options.issuer #316
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
aarongranick-okta
commented
Jan 22, 2020
aarongranick-okta
commented
- issuer is now a required option
- option 'url' is deprecated and no longer used
aarongranick-okta
force-pushed
the
ag-issuer-OKTA-141145
branch
from
eb67897
to
28928c5
Compare
swiftone
reviewed
Jan 22, 2020
| @@ -122,7 +122,7 @@ function addPostMessageListener(sdk, timeout, state) { | |||
| // This may happen if apps with different issuers are running on the same host url | |||
| // If they share the same storage key, they may read and write tokens in the same location. | |||
| // Common when developing against http://localhost | |||
| if (e.origin !== sdk.options.url) { | |||
| if (e.origin !== sdk.getIssuerOrigin()) { | |||
| return reject(new AuthSdkError('The request does not match client configuration')); | |||
There was a problem hiding this comment.
Does it make sense for the error message to be a bit more specific about what doesn't match
There was a problem hiding this comment.
I vaguely recall some discussion around this back when the original code was put in. We want to be careful not to leak any sensitive information, since it does indicate a mismatch between token and app configuration (which is not expected, unless the app has a bug or there are multiple apps on the same domain, like with localhost) - so the error should not be seen by end-users. Welcome for suggestions on this, maybe there is a message which is more helpful but does not reveal anything too specific.
swiftone
approved these changes
Jan 22, 2020
Merged
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.