Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix OAuth request helper to support Authorization header value parsing with non-leading OAuth key #8158

Merged
merged 1 commit into from
Mar 9, 2017
Merged

Fix OAuth request helper to support Authorization header value parsing with non-leading OAuth key #8158

merged 1 commit into from
Mar 9, 2017

Conversation

careys7
Copy link
Member

@careys7 careys7 commented Jan 16, 2017 •
edited by vrann
Loading

This prevents the Web API request validator from throwing a permissions error when OAuth is used in conjunction with Basic authorization (or other Authorization header values).

Fixes #8149

Fix OAuth request helper to support Authorization header value parsin…
717899a 
…g with non-leading OAuth key

This prevents the Web API request validator from throwing a permissions error when OAuth is used in conjunction with Basic authorization (or other Authorization header values).

Fixes #8149
@franckgarnier21
Copy link

Can you improve this to Beared authorization ?

@careys7
Copy link
Member Author

careys7 commented Jan 17, 2017

@franckgarnier21 this would require an OAuth 2.0 implementation (which doesn't exist currently, but I would imagine is on the Magento roadmap).

@careys7 careys7 mentioned this pull request Jan 23, 2017
Closed
@vrann vrann requested review from paliarush and vrann March 1, 2017 20:51
@vrann
Copy link
Contributor

vrann commented Mar 1, 2017

@careys7 can you describe in what use case would you have Basic in front of oAuth? Not clear why both authorizations needed for WebAPI (same comment on #8149)

@vrann vrann self-assigned this Mar 1, 2017
@vrann vrann added this to the March 2017 milestone Mar 1, 2017
@careys7
Copy link
Member Author

careys7 commented Mar 1, 2017

In our case we have a staging website with blanket HTTP Basic in front

@vrann
Copy link
Contributor

vrann commented Mar 1, 2017

@careys7 thanks, makes sense

@paliarush
Copy link
Contributor

@franckgarnier21 OAuth 2.0 authentication with Bearer token is already supported, see http://devdocs.magento.com/guides/v2.0/get-started/authentication/gs-authentication-token.html

@paliarush paliarush requested review from hshar7 and MaxSavich and removed request for hshar7 March 6, 2017 15:54
MaxSavich
MaxSavich approved these changes Mar 6, 2017
View reviewed changes
Copy link
Contributor

@MaxSavich MaxSavich left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as I see OAuth specification does not state that OAuth authentication declaration should be at the first place.

@magento-team magento-team merged commit 717899a into magento:develop Mar 9, 2017
@vrann
Copy link
Contributor

vrann commented Mar 9, 2017

@careys7 Thank you for the contribution!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@paliarush paliarush paliarush approved these changes

@MaxSavich MaxSavich MaxSavich approved these changes

@vrann vrann Awaiting requested review from vrann

Assignees

@vrann vrann

Labels
None yet
Projects
None yet
Milestone
March 2017
Development

Successfully merging this pull request may close these issues.
6 participants
@careys7 @franckgarnier21 @vrann @paliarush @MaxSavich @magento-team