Skip to content

Commit

Permalink
oauth2: allow users to register broken OAuth2 implementations
Browse files Browse the repository at this point in the history
Fixes #111.

Change-Id: Iaea8adb038bcff91b4b468b1a3bdaa5c03d7e8e7
Reviewed-on: https://go-review.googlesource.com/16976
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
  • Loading branch information
rakyll committed Nov 17, 2015
1 parent 2bf5e6e commit 442624c
Show file tree
Hide file tree
Showing 3 changed files with 24 additions and 0 deletions.
4 changes: 4 additions & 0 deletions internal/token.go
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,10 @@ var brokenAuthHeaderProviders = []string{
"https://www.strava.com/oauth/",
}

func RegisterBrokenAuthHeaderProvider(tokenURL string) {
brokenAuthHeaderProviders = append(brokenAuthHeaderProviders, tokenURL)
}

// providerAuthHeaderWorks reports whether the OAuth2 server identified by the tokenURL
// implements the OAuth2 spec correctly
// See https://code.google.com/p/goauth2/issues/detail?id=31 for background.
Expand Down
8 changes: 8 additions & 0 deletions internal/token_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,14 @@ import (
"testing"
)

func TestRegisterBrokenAuthHeaderProvider(t *testing.T) {
RegisterBrokenAuthHeaderProvider("https://aaa.com/")
tokenURL := "https://aaa.com/token"
if providerAuthHeaderWorks(tokenURL) {
t.Errorf("URL: %s is a broken provider", tokenURL)
}
}

func Test_providerAuthHeaderWorks(t *testing.T) {
for _, p := range brokenAuthHeaderProviders {
if providerAuthHeaderWorks(p) {
Expand Down
12 changes: 12 additions & 0 deletions oauth2.go
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,18 @@ import (
// your own context.Context (see https://golang.org/x/net/context).
var NoContext = context.TODO()

// RegisterBrokenAuthHeaderProvider registers an OAuth2 server
// identified by the tokenURL prefix as an OAuth2 implementation
// which doesn't support the HTTP Basic authentication
// scheme to authenticate with the authorization server.
// Once a server is registered, credentials (client_id and client_secret)
// will be passed as query parameters rather than being present
// in the Authorization header.
// See https://code.google.com/p/goauth2/issues/detail?id=31 for background.
func RegisterBrokenAuthHeaderProvider(tokenURL string) {
internal.RegisterBrokenAuthHeaderProvider(tokenURL)
}

// Config describes a typical 3-legged OAuth2 flow, with both the
// client application information and the server's endpoint URLs.
type Config struct {
Expand Down

0 comments on commit 442624c

Please sign in to comment.