trustchain-oc1-orchestral
/
authentik
Archived
10
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

providers/oauth2: ensure response is URL fragment only when implicit or hybrid

This commit is contained in:
Jens Langhammer 2020-12-27 18:15:02 +01:00
parent ce9fb8801c
commit 378fe38b12
1 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
authentik/providers/oauth2/views/authorize.py
View File

@ -95,7 +95,7 @@ class OAuthAuthorizationParams:
# Because in this endpoint we handle both GET # Because in this endpoint we handle both GET
# and POST request. # and POST request.
query_dict = request.POST if request.method == "POST" else request.GET query_dict = request.POST if request.method == "POST" else request.GET
state = query_dict.get("state", "") state = query_dict.get("state")
redirect_uri = query_dict.get("redirect_uri", "") redirect_uri = query_dict.get("redirect_uri", "")
response_type = query_dict.get("response_type", "") response_type = query_dict.get("response_type", "")
@ -192,12 +192,15 @@ class OAuthAuthorizationParams:
def check_nonce(self): def check_nonce(self):
"""Nonce parameter validation.""" """Nonce parameter validation."""
if not self.nonce:
self.nonce = self.state
LOGGER.warning("Using state as nonce for OpenID Request")
if not self.nonce: if not self.nonce:
if SCOPE_OPENID in self.scope: if SCOPE_OPENID in self.scope:
LOGGER.warning("Missing nonce for OpenID Request")
raise AuthorizeError( raise AuthorizeError(
self.redirect_uri, "invalid_request", self.grant_type, self.state self.redirect_uri, "invalid_request", self.grant_type, self.state
) )
self.nonce = ""
def check_code_challenge(self): def check_code_challenge(self):
"""PKCE validation of the transformation method.""" """PKCE validation of the transformation method."""
@ -354,10 +357,17 @@ class OAuthFulfillmentStage(StageView):
self.params.state, self.params.state,
) )
uri = uri._replace( replace_kwargs = {}
query=urlencode(query_params, doseq=True), if self.params.grant_type in [GrantTypes.IMPLICIT, GrantTypes.HYBRID]:
fragment=uri.fragment + urlencode(query_fragment, doseq=True), replace_kwargs = {
) "fragment": uri.fragment + urlencode(query_fragment, doseq=True),
}
else:
replace_kwargs = {
"query": urlencode(query_params, doseq=True),
}
uri = uri._replace(**replace_kwargs)
return urlunsplit(uri) return urlunsplit(uri)