ElyBy-Mirror/oauth2-server
1
0
Fork 0
mirror of https://github.com/elyby/oauth2-server.git synced 2024-11-30 10:42:02 +05:30
Code Issues Packages Projects Releases Wiki Activity

Shuffle the contents of the authorization code payload

Browse Source
This commit is contained in:
Alex Bilbie 2017-07-01 15:30:21 +01:00
parent 63530443fe
commit 4a717104fa
1 changed files with 21 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
src/Grant/AuthCodeGrant.php
View File

@ -311,14 +311,7 @@ class AuthCodeGrant extends AbstractAuthorizeGrant
$authorizationRequest->getScopes() $authorizationRequest->getScopes()
); );
$response = new RedirectResponse(); $payload = [
$response->setRedirectUri(
$this->makeRedirectUri(
$finalRedirectUri,
[
'code' => $this->encrypt(
json_encode(
[
'client_id' => $authCode->getClient()->getIdentifier(), 'client_id' => $authCode->getClient()->getIdentifier(),
'redirect_uri' => $authCode->getRedirectUri(), 'redirect_uri' => $authCode->getRedirectUri(),
'auth_code_id' => $authCode->getIdentifier(), 'auth_code_id' => $authCode->getIdentifier(),
@ -327,7 +320,25 @@ class AuthCodeGrant extends AbstractAuthorizeGrant
'expire_time' => (new \DateTime())->add($this->authCodeTTL)->format('U'), 'expire_time' => (new \DateTime())->add($this->authCodeTTL)->format('U'),
'code_challenge' => $authorizationRequest->getCodeChallenge(), 'code_challenge' => $authorizationRequest->getCodeChallenge(),
'code_challenge_method ' => $authorizationRequest->getCodeChallengeMethod(), 'code_challenge_method ' => $authorizationRequest->getCodeChallengeMethod(),
] '_padding' => base64_encode(random_bytes(mt_rand(8, 256)))
];
// Shuffle the payload so that the structure is no longer know and obvious
$keys = array_keys($payload);
shuffle($keys);
$shuffledPayload = [];
foreach ($keys as $key) {
$shuffledPayload[$key] = $payload[$key];
}
$response = new RedirectResponse();
$response->setRedirectUri(
$this->makeRedirectUri(
$finalRedirectUri,
[
'code' => $this->encrypt(
json_encode(
$shuffledPayload
) )
), ),
'state' => $authorizationRequest->getState(), 'state' => $authorizationRequest->getState(),