Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

oauth2: basic auth should www-url-decode client id and secret #151

Merged
merged 1 commit into from
Apr 14, 2017
Merged

oauth2: basic auth should www-url-decode client id and secret #151

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions access_request_handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import (

"github.com/pkg/errors"
"golang.org/x/net/context"
"net/url"
)

// Implements
Expand Down Expand Up @@ -34,6 +35,7 @@ import (
// client MUST authenticate with the authorization server as described
// in Section 3.2.1.
func (f *Fosite) NewAccessRequest(ctx context.Context, r *http.Request, session Session) (AccessRequester, error) {
var err error
accessRequest := NewAccessRequest(session)

if r.Method != "POST" {
Expand All @@ -53,9 +55,14 @@ func (f *Fosite) NewAccessRequest(ctx context.Context, r *http.Request, session
return accessRequest, errors.Wrap(ErrInvalidRequest, "No grant type given")
}

clientID, clientSecret, ok := r.BasicAuth()
if !ok {
return accessRequest, errors.Wrap(ErrInvalidRequest, "HTTP Authorization header missing or invalid")
// Decode client_id and client_secret which should be in "application/x-www-form-urlencoded" format.
var clientID, clientSecret string
if id, secret, ok := r.BasicAuth(); !ok {
return accessRequest, errors.Wrap(ErrInvalidRequest, "HTTP authorization header missing or invalid")
} else if clientID, err = url.QueryUnescape(id); err != nil {
return accessRequest, errors.Wrap(ErrInvalidRequest, `The client id in the HTTP authorization header could not be decoded from "application/x-www-form-urlencoded"`)
} else if clientSecret, err = url.QueryUnescape(secret); err != nil {
return accessRequest, errors.Wrap(ErrInvalidRequest, `The client secret in the HTTP authorization header could not be decoded from "application/x-www-form-urlencoded"`)
}

client, err := f.Store.GetClient(clientID)
Expand Down