Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added changes from @nicolashenry out of #9248 #9996

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
+73 −45
Open

Added changes from @nicolashenry out of #9248 #9996

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d3caa0d
Added changes from @nicolashenry out of \#9248
Cellebyte Jun 1, 2024
476272d
Merge branch 'master' into apply-patch/nicolashenry
Cellebyte Sep 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 11 additions & 42 deletions dev-helpers/oauth2-redirect.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,13 @@
<!doctype html>
<html lang="en-US">
<body>
</body>
</html>
<script>
'use strict';
function run () {
var oauth2 = window.opener.swaggerUIRedirectOauth2;
var sentState = oauth2.state;
var redirectUrl = oauth2.redirectUrl;
var isValid, qp, arr;
var opener = window.opener;
var oauth2 = opener ? opener.swaggerUIRedirectOauth2 : undefined;

var qp, arr;

if (/code|token|error/.test(window.location.hash)) {
qp = window.location.hash.substring(1).replace('?', '&');
Expand All @@ -25,44 +23,13 @@
}
) : {}

isValid = qp.state === sentState

if ((
oauth2.auth.schema.get("flow") === "accessCode" ||
oauth2.auth.schema.get("flow") === "authorizationCode" ||
oauth2.auth.schema.get("flow") === "authorization_code"
) && !oauth2.auth.code) {
if (!isValid) {
oauth2.errCb({
authId: oauth2.auth.name,
source: "auth",
level: "warning",
message: "Authorization may be unsafe, passed state was changed in server Passed state wasn't returned from auth server"
});
}

if (qp.code) {
delete oauth2.state;
oauth2.auth.code = qp.code;
oauth2.callback({auth: oauth2.auth, redirectUrl: redirectUrl});
} else {
let oauthErrorMsg
if (qp.error) {
oauthErrorMsg = "["+qp.error+"]: " +
(qp.error_description ? qp.error_description+ ". " : "no accessCode received from the server. ") +
(qp.error_uri ? "More info: "+qp.error_uri : "");
}

oauth2.errCb({
authId: oauth2.auth.name,
source: "auth",
level: "error",
message: oauthErrorMsg || "[Authorization failed]: no accessCode received from the server"
});
}
if (oauth2) {
oauth2.handleAuth(qp);
} else {
oauth2.callback({auth: oauth2.auth, token: qp, isValid: isValid, redirectUrl: redirectUrl});
var oauth2Channel = new BroadcastChannel("oauth2_channel");
oauth2Channel.postMessage(qp);
}

window.close();
}

Expand All @@ -74,3 +41,5 @@
});
}
</script>
</body>
</html>
48 changes: 45 additions & 3 deletions src/core/oauth2-authorize.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,11 +122,53 @@ export default function authorize ( { auth, authActions, errActions, configs, au
callback = authActions.authorizeAccessCodeWithFormParams
}

authActions.authPopup(url, {
const oauth2 = {
auth: auth,
state: state,
redirectUrl: redirectUrl,
callback: callback,
errCb: errActions.newAuthErr
})
errCb: errActions.newAuthErr,
handleAuth: (qp) => {
const isValid = qp.state === oauth2.state

if ((
oauth2.auth.schema.get("flow") === "accessCode" ||
oauth2.auth.schema.get("flow") === "authorizationCode" ||
oauth2.auth.schema.get("flow") === "authorization_code"
) && !oauth2.auth.code) {
if (!isValid) {
oauth2.errCb({
authId: oauth2.auth.name,
source: "auth",
level: "warning",
message: "Authorization may be unsafe, passed state was changed in server Passed state wasn't returned from auth server"
})
}

if (qp.code) {
delete oauth2.state
oauth2.auth.code = qp.code
oauth2.callback({auth: oauth2.auth, redirectUrl: redirectUrl})
} else {
let oauthErrorMsg
if (qp.error) {
oauthErrorMsg = "["+qp.error+"]: " +
(qp.error_description ? qp.error_description+ ". " : "no accessCode received from the server. ") +
(qp.error_uri ? "More info: "+qp.error_uri : "")
}

oauth2.errCb({
authId: oauth2.auth.name,
source: "auth",
level: "error",
message: oauthErrorMsg || "[Authorization failed]: no accessCode received from the server"
})
}
} else {
oauth2.callback({auth: oauth2.auth, token: qp, isValid: isValid, redirectUrl: redirectUrl})
}
}
}

authActions.authPopup(url, oauth2)
}
17 changes: 17 additions & 0 deletions src/core/plugins/auth/actions.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,10 @@ export const preAuthorizeImplicit = (payload) => ( { authActions, errActions } )

// remove oauth2 property from window after redirect from authentication
delete win.swaggerUIRedirectOauth2
if (win.oauth2Channel) {
win.oauth2Channel.close()
delete win.oauth2Channel
}

if ( flow !== "accessCode" && !isValid ) {
errActions.newAuthErr( {
Expand Down Expand Up @@ -284,5 +288,18 @@ export const persistAuthorizationIfNeeded = () => ( { authSelectors, getConfigs
export const authPopup = (url, swaggerUIRedirectOauth2) => ( ) => {
win.swaggerUIRedirectOauth2 = swaggerUIRedirectOauth2

if (win.oauth2Channel) {
win.oauth2Channel.close()
}
const oauth2Channel = new BroadcastChannel("oauth2_channel")
oauth2Channel.addEventListener("message", event => {
const data = event.data
const state = data ? data.state : undefined
if (state === swaggerUIRedirectOauth2.state) {
swaggerUIRedirectOauth2.handleAuth(data)
}
})
win.oauth2Channel = oauth2Channel

win.open(url)
}