Erick Torres
88ccb6ff13
Fix codeVerifier check. Keep code style.
2017-07-07 12:35:42 -05:00
Erick Torres
fbb3586cae
Merge branch 'master' of github.com:erickjth/oauth2-server into fix-pkce-implementation
...
# Conflicts:
# src/Grant/AuthCodeGrant.php
# tests/Grant/AuthCodeGrantTest.php
2017-07-07 12:06:32 -05:00
Jérôme Parmentier
88bf8b2367
Fix missing sprintf
2017-07-03 20:28:28 +02:00
Alex Bilbie
f5c3ba0b24
Removed dead code
2017-07-01 18:22:51 +01:00
Alex Bilbie
523434902c
Removed dead code
2017-07-01 18:15:41 +01:00
Alex Bilbie
76c2b6f88c
AuthorizationServer no longer needs to know about the public key
2017-07-01 18:11:10 +01:00
Alex Bilbie
72349ef22f
Encryption key is now always required so remove redundent code
2017-07-01 18:10:53 +01:00
Alex Bilbie
850793ab88
Added missing methods
2017-07-01 18:08:49 +01:00
Alex Bilbie
0f73bf0054
Encryption key just uses Defuse\Crypto now, no key based crypto
2017-07-01 18:07:51 +01:00
Alex Bilbie
aee1779432
Apply fixes from StyleCI
2017-07-01 16:19:23 +00:00
Alex Bilbie
765a01021b
Updated error message
2017-07-01 16:45:29 +01:00
Alex Bilbie
0706d66c76
Don’t pad and shuffle the payload if an encryption key has been set
2017-07-01 16:45:29 +01:00
Alex Bilbie
e123fe82d0
Ignore error_log messages in code coverage
2017-07-01 16:45:29 +01:00
Alex Bilbie
1954120c3d
Use catch all exception
2017-07-01 16:45:29 +01:00
Alex Bilbie
dd5eee150d
Ensure response type also has access to the encryption key
2017-07-01 16:45:29 +01:00
Alex Bilbie
1af4012df4
New property on AuthorizationServer to receive an encryption key which is used for future encryption/decryption instead of keybased encryption/decryption
2017-07-01 16:45:29 +01:00
Alex Bilbie
4a717104fa
Shuffle the contents of the authorization code payload
2017-07-01 16:45:29 +01:00
Alex Bilbie
63530443fe
Better error checking when saving a temporary key to ensure file was written successfully and the server is the exclusive mode
2017-07-01 16:44:57 +01:00
Alex Bilbie
2f8de3d230
Ensure the server is the exclusive owner of the key
2017-07-01 16:44:51 +01:00
Alex Bilbie
57d199b889
Stricter validation of code challenge value to match RFC 7636 requirements
2017-07-01 16:44:43 +01:00
Alex Bilbie
6bdd108145
Escape scope parameter to reduce pontential XSS vector
2017-07-01 16:43:31 +01:00
Diogo Oliveira de Melo
170ce2fd2d
Replaces array_key_exists by isset, which is faster, on ImplicitGrant.
2017-06-30 15:42:23 -03:00
Erick Torres
880e3b4590
Fix invalid code_challenge_method key.
2017-06-16 12:03:04 -05:00
Erick Torres
2167edf1d9
Validate codeVerifier and codeChallenge correctly.
2017-06-16 12:02:48 -05:00
Erick Torres
2482630221
Fix codeVerifier hash verification.
2017-06-16 12:02:34 -05:00
Dave Marshall
83228bdcd5
Change case for implict grant token_type
2017-03-27 12:11:25 +01:00
Stanimir Stoyanov
d73b15ae32
Getter and setter for the payload and ability to pass options to json_encode
2017-03-20 14:52:35 +02:00
Ian Littman
d8ece093d5
Add hasRedirect() method for OAuthServerException
...
Resolves #694 .
2017-02-04 14:50:46 -05:00
François Kooman
6426e597a3
Fix PKCE code verifier encoding to match specification
...
The current implementation of PKCE does not follow the specification
correctly regarding the encoding of the code verifier. This patch
correctly encodes the hash of the code verifier according to
Appenix A of RFC 7636.
2017-01-24 11:36:34 +01:00
jeremykendall
01677a564e
Fix WWW-Authenticate entry in $headers array
...
In this context the header name should be the array key and the header
value the array value.
2016-10-11 22:27:24 -05:00
Alex Bilbie
b1bfff7325
Don't pass in user because we don't know who user is
2016-09-19 10:05:55 +01:00
Alex Bilbie
11ccc305d0
Applied fixes from StyleCI
2016-09-13 14:17:09 +00:00
Alex Bilbie
d7df2f7e24
Fix for #650
2016-09-13 15:16:58 +01:00
Julián Gutiérrez
065ef5db99
CryptKey tests
2016-07-19 17:15:36 +02:00
Julián Gutiérrez
039537ebe2
touch!
2016-07-19 15:06:32 +02:00
Julián Gutiérrez
d8930af5ee
key file auto-generation from string
2016-07-19 15:01:31 +02:00
Ian Littman
090c01d3d1
Allow easy addition of custom fields to Bearer token response
2016-07-16 10:27:33 -05:00
Pierre Rineau
57323f38f7
while(array_shift()) makes the AuthorizationServer class configuration mutable
2016-07-13 12:03:05 +02:00
Lukáš Unger
c874c59b9c
Explicitly compare to false when checking not instanceof
2016-07-09 12:09:21 +02:00
Lukáš Unger
c3a4670c11
Updated PHPDoc
2016-07-09 02:01:53 +02:00
Luca Degasperi
655a4b2715
Make ClientRepositoryInterface more flexible
...
This small change will allow the use of the ```ClientRepositoryInterface``` for more use cases than simply validating clients when authorizing them. There might be some places where this change will affect the behavior. I also think the ```$mustValidateSecret``` is redundant since in an implementation a check could be done wether ```$clientSecret``` is null or not.
2016-06-30 16:49:47 +02:00
Alex Bilbie
5ee1583c5b
Ensure state is in access denied redirect. Fixes #597
2016-06-28 09:03:01 +01:00
Alex Bilbie
66de05a395
Merge pull request #605 from jfilla/master
...
Added catch Runtime exception when parsing JWT string
2016-06-28 08:49:29 +01:00
Alex Bilbie
df20da1235
Merge pull request #601 from zerkms/ISSUE-596_UNIQUE_ACCESS_TOKEN
...
Added a check for unique access token constraint violation
2016-06-28 08:48:38 +01:00
Jakub Filla
9eccc40eb6
Added catch Runtime exception when parsing JWT string
2016-06-22 12:38:03 +02:00
Ian Littman
9775c0076b
Look at Authorization header directly for HTTP Basic auth check
...
Should allow for better compatibility with server implementations that aren't sitting on top of a standard SAPI (e.g. persistent web servers building a PSR-7 compatible request from a socket-received message).
One catch here is that I've seen Apache hijack the HTTP Authorization header in the past, though that would probably impact the other aspects of the server just as much as it would this, so I think that risk is manageable.
Added tests to cover all paths through the new code, so the AbstractGrant type still has 100% coverage :)
Did notice that, as of the latest versions of PHPUnit, the mock creation method is deprecated. Maybe that needs to be updated? Haven't checked to see whether the replacements are PHPUnit 4.8 compatible though, so maybe they need to stay in order to test on older PHP versions?
2016-06-21 21:08:38 -05:00
Ivan Kurnosov
b68ef973df
Added a check for unique access token constraint violation
2016-06-20 20:19:03 +12:00
Ivan Kurnosov
6b88cbeb13
Removed isExpired() from interfaces and traits
2016-06-17 19:50:04 +12:00
Julián Gutiérrez
22e6a350dd
unify middleware exception responses
2016-05-11 14:13:58 +02:00
İsmail BASKIN
9a58bc15f6
Include redirect_uri check on authorization endpoint on implicit grant
2016-05-07 17:44:02 +03:00
