From b81e6eeff9ec9529287633f573b89689ff702558 Mon Sep 17 00:00:00 2001 From: Kagami Sascha Rosylight Date: Thu, 15 Jun 2023 22:19:05 +0200 Subject: [PATCH] rfc 8252 --- packages/backend/src/server/oauth/OAuth2ProviderService.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/backend/src/server/oauth/OAuth2ProviderService.ts b/packages/backend/src/server/oauth/OAuth2ProviderService.ts index 58b2c9afa..76786829a 100644 --- a/packages/backend/src/server/oauth/OAuth2ProviderService.ts +++ b/packages/backend/src/server/oauth/OAuth2ProviderService.ts @@ -42,6 +42,7 @@ function validateClientId(raw: string): URL { // https://datatracker.ietf.org/doc/html/rfc6749.html#section-3.1.2.1 // 'The redirection endpoint SHOULD require the use of TLS as described // in Section 1.6 when the requested response type is "code" or "token"' + // TODO: Consider allowing custom URIs per RFC 8252. const allowedProtocols = process.env.NODE_ENV === 'test' ? ['http:', 'https:'] : ['https:']; if (!allowedProtocols.includes(url.protocol)) { throw new AuthorizationError('client_id must be a valid HTTPS URL', 'invalid_request'); @@ -318,7 +319,7 @@ export class OAuth2ProviderService { const clientUrl = validateClientId(clientID); - // TODO: Consider allowing this for native apps (RFC 8252) + // TODO: Consider allowing localhost for native apps (RFC 8252) // The current setup requires an explicit list of redirect_uris per // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-4.1.3 // which blocks the support. But we could loose the rule in this case.