-
-
Notifications
You must be signed in to change notification settings - Fork 367
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
authorize: defined OAuth2.HandleResponseTypes
Incorporated feedback from GitHub, did refactoring and renaming, added tests
- Loading branch information
Aeneas Rekkas
committed
Jan 6, 2016
1 parent
1871702
commit 30b6e74
Showing
12 changed files
with
408 additions
and
148 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| package fosite | ||
|
|
||
| import ( | ||
| . "github.com/ory-am/fosite/client" | ||
| "github.com/stretchr/testify/assert" | ||
| "net/url" | ||
| "testing" | ||
| ) | ||
|
|
||
| // TODO rfc6749 3.1. Authorization Endpoint | ||
| // The endpoint URI MAY include an "application/x-www-form-urlencoded" formatted (per Appendix B) query component | ||
| // | ||
| // rfc6749 3.1.2. Redirection Endpoint | ||
| // "The redirection endpoint URI MUST be an absolute URI as defined by [RFC3986] Section 4.3" | ||
| func TestGetRedirectURI(t *testing.T) { | ||
| for _, c := range []struct { | ||
| in string | ||
| isError bool | ||
| expected string | ||
| }{ | ||
| {in: "", isError: true}, | ||
| } { | ||
| values := url.Values{} | ||
| values.Set("redirect_uri", c.in) | ||
| res, err := redirectFromValues(values) | ||
| assert.Equal(t, c.isError, err != nil, "%s", err) | ||
| if err == nil { | ||
| assert.Equal(t, c.expected, res) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // rfc6749 10.6. | ||
| // Authorization Code Redirection URI Manipulation | ||
| // The authorization server MUST require public clients and SHOULD require confidential clients | ||
| // to register their redirection URIs. If a redirection URI is provided | ||
| // in the request, the authorization server MUST validate it against the | ||
| // registered value. | ||
| // | ||
| // rfc6819 4.4.1.7. | ||
| // Threat: Authorization "code" Leakage through Counterfeit Client | ||
| // The authorization server may also enforce the usage and validation | ||
| // of pre-registered redirect URIs (see Section 5.2.3.5). | ||
| func TestDoesClientWhiteListRedirect(t *testing.T) { | ||
| var err error | ||
| var redir string | ||
|
|
||
| for k, c := range []struct { | ||
| client Client | ||
| url string | ||
| isError bool | ||
| expected string | ||
| }{ | ||
| { | ||
| client: &SecureClient{RedirectURIs: []string{""}}, | ||
| url: "http://foo.com/cb", | ||
| isError: true, | ||
| }, | ||
| { | ||
| client: &SecureClient{RedirectURIs: []string{"http://bar.com/cb"}}, | ||
| url: "http://foo.com/cb", | ||
| isError: true, | ||
| }, | ||
| { | ||
| client: &SecureClient{RedirectURIs: []string{"http://bar.com/cb"}}, | ||
| url: "", | ||
| isError: false, | ||
| expected: "http://bar.com/cb", | ||
| }, | ||
| { | ||
| client: &SecureClient{RedirectURIs: []string{""}}, | ||
| url: "", | ||
| isError: true, | ||
| }, | ||
| { | ||
| client: &SecureClient{RedirectURIs: []string{"http://bar.com/cb"}}, | ||
| url: "http://bar.com/cb", | ||
| isError: false, | ||
| expected: "http://bar.com/cb", | ||
| }, | ||
| { | ||
| client: &SecureClient{RedirectURIs: []string{"http://bar.com/cb"}}, | ||
| url: "http://bar.com/cb123", | ||
| isError: true, | ||
| }, | ||
| } { | ||
| redir, err = redirectFromClient(c.url, c.client) | ||
| assert.Equal(t, c.isError, err != nil, "%d: %s", k, err) | ||
| assert.Equal(t, c.expected, redir) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| package fosite | ||
|
|
||
| import ( | ||
| "errors" | ||
| "golang.org/x/net/context" | ||
| "net/http" | ||
| ) | ||
|
|
||
| var ErrInvalidResponseType = errors.New("This handler is unable handle any of the response types requested by the auhtorize request") | ||
| var ErrNoResponseTypeHandlerFound = errors.New("None of the handler's are able to handle this authorize request") | ||
|
|
||
| type ResponseTypeHandler interface { | ||
| // HandleResponseType handles an authorize request. To extend the handler's capabilities, the http request | ||
| // is passed along, if further information retrieval is required. | ||
| // | ||
| // If HandleResponseType fails, the handler implementation MUST return ErrInvalidResponseType. | ||
| HandleResponseType(context.Context, *Response, AuthorizeRequest, http.Request) error | ||
| } | ||
|
|
||
| // NewAuthorizeResponse iterates through all response type handlers and returns their result or | ||
| // ErrNoResponseTypeHandlerFound if none of the handler's were able to handle it. | ||
| // | ||
| // Important: Every ResponseTypeHandler should return ErrInvalidResponseType if it is unable to handle | ||
| // the given request and an arbitrary error if an error occurred | ||
| func (o *OAuth2) NewAuthorizeResponse(ctx context.Context, ar *AuthorizeRequest, r *http.Request) (*Response, error) { | ||
| var resp = new(Response) | ||
| var err error | ||
| var found bool | ||
|
|
||
| for _, h := range o.ResponseTypeHandlers { | ||
| // Dereference http request and authorize request so handler's can't mess with it. | ||
| err = h.HandleResponseType(ctx, resp, *ar, *r) | ||
| if err == nil { | ||
| found = true | ||
| } else if err != ErrInvalidResponseType { | ||
| return nil, err | ||
| } | ||
| } | ||
|
|
||
| if !found { | ||
| return nil, ErrNoResponseTypeHandlerFound | ||
| } | ||
|
|
||
| return resp, nil | ||
| } |
Oops, something went wrong.