Skip to content

Commit

Permalink
switch to GET method when taking user consent
Browse files Browse the repository at this point in the history
Currently bshaffer oauth library has a bug when POST is used on AuthorizeEndpoint along with nonce
(optional parameter) which fails to set the nonce in id_token
  • Loading branch information
ashfame committed Sep 21, 2022
1 parent 48515e6 commit ebd4033
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 2 deletions.
2 changes: 1 addition & 1 deletion src/Http/Handlers/AuthorizeHandler.php
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ public function handle( Request $request, Response $response ): Response {

$user = wp_get_current_user();
if ( $this->consent_storage->needs_consent( $user->ID ) ) {
if ( ! isset( $_POST['authorize'] ) || 'Authorize' !== $_POST['authorize'] ) {
if ( ! isset( $_REQUEST['authorize'] ) || 'Authorize' !== $_REQUEST['authorize'] ) {
$response->send();
exit;
}
Expand Down
2 changes: 1 addition & 1 deletion templates/authenticate/form.php
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<?php /** @var stdClass $data */ ?>

<form method="post" action="<?php echo esc_url( $data->form_url ); ?>">
<form method="GET" action="<?php echo esc_url( $data->form_url ); ?>">
<?php wp_nonce_field( 'wp_rest' ); /* The nonce will give the REST call the userdata. */ ?>
<?php foreach ( $data->form_fields as $key => $value ) : ?>
<input type="hidden" name="<?php echo esc_attr( $key ); ?>" value="<?php echo esc_attr( $value ); ?>"/>
Expand Down

0 comments on commit ebd4033

Please sign in to comment.