oauth 1.1.8 → 1.1.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- checksums.yaml.gz.sig +0 -0
- data/CHANGELOG.md +128 -1
- data/LICENSE.md +1 -1
- data/README.md +63 -84
- data/lib/oauth/consumer.rb +27 -5
- data/lib/oauth/tokens/access_token.rb +18 -0
- data/lib/oauth/version.rb +4 -1
- data/lib/oauth.rb +1 -2
- data/sig/oauth.rbs +32 -0
- data.tar.gz.sig +0 -0
- metadata +39 -57
- metadata.gz.sig +0 -0
- data/CITATION.cff +0 -20
- data/CODE_OF_CONDUCT.md +0 -134
- data/CONTRIBUTING.md +0 -275
- data/FUNDING.md +0 -70
- data/MIT.md +0 -21
- data/RUBOCOP.md +0 -71
- data/SECURITY.md +0 -21
- data/certs/pboling.pem +0 -27
- data/sig/oauth/consumer.rbs +0 -9
- data/sig/oauth/signature/base.rbs +0 -12
- data/sig/oauth/tokens/token.rbs +0 -8
- data/sig/oauth/version.rbs +0 -6
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 28e76cbac214026cc265230f4f5c80a4be1a7e745831f36d74ce44ab1b994f57
|
|
4
|
+
data.tar.gz: f67c5f55da92b60bd2f130e09091f504849ec57aca1de15900764a83100d445e
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: f7c5409cdb4befc5efdaa4e69bf7596a3b4d6775cb133e3233faf02f937b9f86a7a4fd6180b93451e5da4307f01da142136dd7e24ce1efb6be557e0519f2f879
|
|
7
|
+
data.tar.gz: c83606954e0b52b5340d0b62c36815f349bced3e076f3d8c15762ed38708c3e22253e686a2b4f2d398c603ca2106b5da33227a2199a0e3afb0b3fa42c17dbf1e
|
checksums.yaml.gz.sig
CHANGED
|
Binary file
|
data/CHANGELOG.md
CHANGED
|
@@ -30,6 +30,131 @@ Please file a bug if you notice a violation of semantic versioning.
|
|
|
30
30
|
|
|
31
31
|
### Security
|
|
32
32
|
|
|
33
|
+
## [1.1.9] - 2026-11-07
|
|
34
|
+
|
|
35
|
+
- TAG: [v1.1.9][1.1.9t]
|
|
36
|
+
- COVERAGE: 88.05% -- 862/979 lines in 34 files
|
|
37
|
+
- BRANCH COVERAGE: 62.63% -- 176/281 branches in 34 files
|
|
38
|
+
- 41.57% documented
|
|
39
|
+
|
|
40
|
+
### Added
|
|
41
|
+
|
|
42
|
+
- `access_token_cross_origin_requests` consumer option (default `false`): `AccessToken#request` now refuses an absolute service URI whose origin differs from the configured `:site`, raising `OAuth::Error`, so the signed OAuth `Authorization` header is not sent to a different host. Same-origin absolute URIs and relative paths are unaffected. Set the option to `true` to restore cross-origin service calls. [CWE-918]
|
|
43
|
+
|
|
44
|
+
- kettle-jem-template-20260720-001 - READMEs can now display configured
|
|
45
|
+
corporate sponsor logos.
|
|
46
|
+
|
|
47
|
+
- Spec coverage for `OAuth::Client::Helper`, the `query_string` OAuth signing scheme in
|
|
48
|
+
`lib/oauth/client/net_http.rb`, and the `OAuth::Error`/`OAuth::Unauthorized`/`OAuth::Problem`
|
|
49
|
+
classes — none previously had a dedicated spec file.
|
|
50
|
+
- kettle-jem-template-20260720-005 - README Support & Community links now
|
|
51
|
+
include RubyForum.
|
|
52
|
+
- kettle-jem-template-20260726-001 - Projects now include YARD lint
|
|
53
|
+
configuration and documentation dependencies so documentation issues fail
|
|
54
|
+
before generated docs are refreshed.
|
|
55
|
+
- kettle-jem-template-20260727-001 - Spec harness documentation now lists the
|
|
56
|
+
RSpec helpers provided by `kettle-test`.
|
|
57
|
+
- kettle-jem-template-20260729-005 - Gemspec metadata now publishes this
|
|
58
|
+
project's RubyForum tag as `mailing_list_uri`, and support docs link to the
|
|
59
|
+
tagged RubyForum community alongside Discord.
|
|
60
|
+
|
|
61
|
+
- kettle-jem-template-20260913-001 - Templating now also surfaces a review
|
|
62
|
+
entry in `dependency_conflicts.resolve` when a direct development
|
|
63
|
+
dependency doesn't support one or more of this project's declared
|
|
64
|
+
`engines:` and has no template-managed modular home (e.g. `sqlite3` on
|
|
65
|
+
`jruby`). Review each entry and pick a resolution per the project's own
|
|
66
|
+
engine support needs.
|
|
67
|
+
|
|
68
|
+
### Changed
|
|
69
|
+
|
|
70
|
+
- [kc] kettle-jem/prepare: updated 22 project files:
|
|
71
|
+
- configuration (2)
|
|
72
|
+
- dependencies (20)
|
|
73
|
+
|
|
74
|
+
- [kc] kettle-jem/template: updated 51 project files:
|
|
75
|
+
- code and tests (3)
|
|
76
|
+
- dependencies (7)
|
|
77
|
+
- documentation (2)
|
|
78
|
+
- other (4)
|
|
79
|
+
- workflows (35)
|
|
80
|
+
|
|
81
|
+
- Dependency floors raised to the latest releases, including auth-sanitizer >= 0.2.4 (Hash#inspect redaction in debug logging, GHSA-cmh8-5q25-68v6).
|
|
82
|
+
|
|
83
|
+
- kettle-jem-template-20260716-002 - Generated gemspec manifests now ship fewer
|
|
84
|
+
repository-only files by default to reduce downstream distro packaging churn.
|
|
85
|
+
|
|
86
|
+
- kettle-jem-template-20260720-002 - Development Gemfiles now use the released
|
|
87
|
+
`tree_sitter_language_pack` gem 1.13.3 or newer by default.
|
|
88
|
+
- kettle-jem-template-20260725-002 - Version specs now use `anonymous_loader` to
|
|
89
|
+
cover `version.rb` without redefining constants, or are removed when version
|
|
90
|
+
specs are not managed for the project.
|
|
91
|
+
- kettle-jem-template-20260728-001 - Generated Ruby workflows now use clearer
|
|
92
|
+
setup-ruby-flash planning and can prepare appraisal-only jobs without
|
|
93
|
+
installing the main Gemfile bundle.
|
|
94
|
+
|
|
95
|
+
- kettle-jem-template-20260801-001 - Generated README gem dashboard links now
|
|
96
|
+
use ClickGems instead of BestGems.
|
|
97
|
+
|
|
98
|
+
- [kc] kettle-jem/prepare: updated 15 project files:
|
|
99
|
+
- configuration (1)
|
|
100
|
+
- dependencies (14)
|
|
101
|
+
|
|
102
|
+
- [kc] kettle-jem/template: updated 50 project files:
|
|
103
|
+
- code and tests (1)
|
|
104
|
+
- configuration (1)
|
|
105
|
+
- dependencies (12)
|
|
106
|
+
- documentation (1)
|
|
107
|
+
- other (3)
|
|
108
|
+
- workflows (32)
|
|
109
|
+
|
|
110
|
+
### Fixed
|
|
111
|
+
|
|
112
|
+
- Token inspection specs no longer treat hexadecimal object identifiers as leaked secrets.
|
|
113
|
+
|
|
114
|
+
- kettle-jem-template-20260720-003 - StructuredMerge Git diff driver config now
|
|
115
|
+
uses the installed `smorg-rb` driver command.
|
|
116
|
+
- kettle-jem-template-20260725-001 - Release pull request branches beginning
|
|
117
|
+
with `feature/release` now run JRuby and TruffleRuby workflows.
|
|
118
|
+
- kettle-jem-template-20260726-002 - Generated version files now document their
|
|
119
|
+
version namespace and constants, reducing warning-only YARD lint output.
|
|
120
|
+
- kettle-jem-template-20260726-003 - Coverage upload steps now treat Coveralls,
|
|
121
|
+
QLTY, and Codecov as optional, so provider outages do not fail CI when local
|
|
122
|
+
coverage thresholds still pass.
|
|
123
|
+
- kettle-jem-template-20260728-002 - Generated RuboCop configs now ignore the
|
|
124
|
+
same `gemfiles/vendor/bundle` tree as `.gitignore`, so vendored dependency
|
|
125
|
+
installs are not reported as project lint debt.
|
|
126
|
+
- kettle-jem-template-20260728-003 - Generated dep-heads workflows now run
|
|
127
|
+
TruffleRuby jobs with current RubyGems and Bundler, avoiding setup failures
|
|
128
|
+
before the test suite starts.
|
|
129
|
+
- kettle-jem-template-20260728-004 - Generated dep-heads workflows now use the
|
|
130
|
+
setup-ruby Bundler install path for direct appraisal Gemfiles, avoiding rv
|
|
131
|
+
lockfile parser failures on Git and path dependencies.
|
|
132
|
+
- kettle-jem-template-20260728-005 - VersionGem bootstrap now creates the
|
|
133
|
+
missing canonical version spec when a project only has shim namespace version
|
|
134
|
+
specs.
|
|
135
|
+
- kettle-jem-template-20260729-001 - Generated JRuby 9.4 workflows now use the
|
|
136
|
+
legacy manual bundle install path, avoiding setup-time Bundler full-index
|
|
137
|
+
failures against `gem.coop`.
|
|
138
|
+
- kettle-jem-template-20260730-001 - Gemspec package file enumeration now runs
|
|
139
|
+
relative to the gemspec directory, so release package contents stay correct
|
|
140
|
+
even when the gemspec is loaded from another working directory.
|
|
141
|
+
|
|
142
|
+
- Remove duplicate loading of the version file from the public entrypoint.
|
|
143
|
+
|
|
144
|
+
- kettle-jem-template-20260801-002 - Generated RSpec helpers now normalize
|
|
145
|
+
managed configuration block bindings structurally, preventing mixed block
|
|
146
|
+
parameter names from producing invalid configuration after a merge.
|
|
147
|
+
- kettle-jem-template-20260801-003 - Generated project metadata and
|
|
148
|
+
documentation now normalize configured underscore hostnames to valid
|
|
149
|
+
hyphenated hostnames.
|
|
150
|
+
- kettle-jem-template-20260801-004 - Generated organization README logos now
|
|
151
|
+
use GitHub's stable organization avatar endpoint instead of assuming a
|
|
152
|
+
matching Galtzo-hosted asset exists.
|
|
153
|
+
- kettle-jem-template-20260802-001 - Devcontainer JSON files now merge as JSONC,
|
|
154
|
+
preserving comments and trailing commas during template updates.
|
|
155
|
+
|
|
156
|
+
- Exclude optional OAuth adapters from the default coverage scope.
|
|
157
|
+
|
|
33
158
|
## [1.1.8] - 2026-07-15
|
|
34
159
|
|
|
35
160
|
- TAG: [v1.1.8][1.1.8t]
|
|
@@ -863,7 +988,9 @@ All together now release
|
|
|
863
988
|
- Moved all non-Rails functionality from the Rails plugin:
|
|
864
989
|
http://code.google.com/p/oauth-plugin/
|
|
865
990
|
|
|
866
|
-
[Unreleased]: https://github.com/ruby-oauth/oauth/compare/v1.1.
|
|
991
|
+
[Unreleased]: https://github.com/ruby-oauth/oauth/compare/v1.1.9...HEAD
|
|
992
|
+
[1.1.9]: https://github.com/ruby-oauth/oauth/compare/v1.1.8...v1.1.9
|
|
993
|
+
[1.1.9t]: https://github.com/ruby-oauth/oauth/releases/tag/v1.1.9
|
|
867
994
|
[1.1.8]: https://github.com/ruby-oauth/oauth/compare/v1.1.7...v1.1.8
|
|
868
995
|
[1.1.8t]: https://github.com/ruby-oauth/oauth/releases/tag/v1.1.8
|
|
869
996
|
[1.1.7]: https://github.com/ruby-oauth/oauth/compare/v1.1.6...v1.1.7
|
data/LICENSE.md
CHANGED
data/README.md
CHANGED
|
@@ -1,16 +1,17 @@
|
|
|
1
|
-
<a href="https://github.com/ruby-oauth"><img alt="ruby-oauth Logo by
|
|
1
|
+
<a href="https://github.com/ruby-oauth"><img alt="ruby-oauth Logo by GitHub" src="https://github.com/ruby-oauth.png?size=192" width="14%" align="right"/></a>
|
|
2
2
|
|
|
3
|
-
#
|
|
3
|
+
# 🔑 OAuth
|
|
4
4
|
|
|
5
|
-
[![Version][👽versioni]][👽version] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license] [![
|
|
5
|
+
[![Version][👽versioni]][👽version] [![Ruby Users Forum][✉️ruby-forum-top-img]][✉️ruby-forum] [![GitHub tag (latest SemVer)][⛳️tag-img]][⛳️tag] [![License: MIT][📄license-img]][📄license] [![Total downloads][👽dl-ranki]][👽dl-rank] [![CodeCov Test Coverage][🏀codecovi]][🏀codecov] [![Coveralls Test Coverage][🏀coveralls-img]][🏀coveralls] [![QLTY Test Coverage][🏀qlty-covi]][🏀qlty-cov] [![QLTY Maintainability][🏀qlty-mnti]][🏀qlty-mnt] [![CI Heads][🚎3-hd-wfi]][🚎3-hd-wf] [![CI Runtime Dependencies @ HEAD][🚎12-crh-wfi]][🚎12-crh-wf] [![CI Current][🚎11-c-wfi]][🚎11-c-wf] [![CI Truffle Ruby][🚎9-t-wfi]][🚎9-t-wf] [![CI JRuby][🚎10-j-wfi]][🚎10-j-wf] [![Deps Locked][🚎13-🔒️-wfi]][🚎13-🔒️-wf] [![Deps Unlocked][🚎14-🔓️-wfi]][🚎14-🔓️-wf] [![CI Test Coverage][🚎2-cov-wfi]][🚎2-cov-wf] [![CI Style][🚎5-st-wfi]][🚎5-st-wf] [![Apache SkyWalking Eyes License Compatibility Check][🚎15-🪪-wfi]][🚎15-🪪-wf]
|
|
6
6
|
|
|
7
|
-
`if ci_badges.map(&:color).detect { it != "green"}` ☝️ [let me know][✉️discord-invite], as I may have missed the
|
|
7
|
+
`if ci_badges.map(&:color).detect { it != "green"}` ☝️ [let me know on Discord][✉️discord-invite] or [RubyForum][✉️ruby-forum], as I may have missed the notification.
|
|
8
8
|
|
|
9
9
|
---
|
|
10
10
|
|
|
11
11
|
`if ci_badges.map(&:color).all? { it == "green"}` 👇️ send money so I can do more of this. FLOSS maintenance is now my full-time job.
|
|
12
12
|
|
|
13
13
|
[![OpenCollective Backers][🖇osc-backers-i]][🖇osc-backers] [![OpenCollective Sponsors][🖇osc-sponsors-i]][🖇osc-sponsors] [![Sponsor Me on Github][🖇sponsor-img]][🖇sponsor] [![Liberapay Goal Progress][⛳liberapay-img]][⛳liberapay] [![Donate on PayPal][🖇paypal-img]][🖇paypal] [![Buy me a coffee][🖇buyme-small-img]][🖇buyme] [![Donate at ko-fi.com][🖇kofi-img]][🖇kofi]
|
|
14
|
+
<p><sub>Corporate sponsor: <a href="https://serpapi.com"><img alt="SerpApi" src="https://serpapi.com/assets/media_kit/logo-with-wordmark.svg" height="24"/></a> <a href="#-floss-funding">Become a sponsor</a></sub></p>
|
|
14
15
|
|
|
15
16
|
<details markdown="1">
|
|
16
17
|
<summary>👣 How will this project approach the September 2025 hostile takeover of RubyGems? 🚑️</summary>
|
|
@@ -70,12 +71,12 @@ The primary maintainer since 2020 is Peter Boling ([@pboling](https://github.com
|
|
|
70
71
|
| Tokens to Remember | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace] |
|
|
71
72
|
|-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
72
73
|
| Works with JRuby | [![JRuby 9.2 Compat][💎jruby-9.2i]][🚎jruby-9.2-wf] [![JRuby 9.3 Compat][💎jruby-9.3i]][🚎jruby-9.3-wf] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎jruby-9.4-wf] [![JRuby 10.0 Compat][💎jruby-10.0i]][🚎jruby-10.0-wf] [![JRuby current Compat][💎jruby-c-i]][🚎10-j-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf]|
|
|
73
|
-
| Works with Truffle Ruby | [![Truffle Ruby 22.3 Compat][💎truby-22.3i]][🚎truby-22.3-wf] [![Truffle Ruby 23.
|
|
74
|
+
| Works with Truffle Ruby | [![Truffle Ruby 22.3 Compat][💎truby-22.3i]][🚎truby-22.3-wf] [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎truby-23.1-wf] <br/> [![Truffle Ruby 24.2 Compat][💎truby-24.2i]][🚎truby-24.2-wf] [![Truffle Ruby 25.0 Compat][💎truby-25.0i]][🚎truby-25.0-wf] [![Truffle Ruby 33.0 Compat][💎truby-33.0i]][🚎truby-33.0-wf] [![Truffle Ruby current Compat][💎truby-c-i]][🚎9-t-wf]|
|
|
74
75
|
| Works with MRI Ruby 4 | [![Ruby current Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf]|
|
|
75
76
|
| Works with MRI Ruby 3 | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎ruby-3.0-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎ruby-3.1-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎ruby-3.2-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎ruby-3.3-wf] [![Ruby 3.4 Compat][💎ruby-3.4i]][🚎ruby-3.4-wf]|
|
|
76
77
|
| Works with MRI Ruby 2 | ![Ruby 2.3 Compat][💎ruby-2.3i] <br/> [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎ruby-2.4-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎ruby-2.5-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎ruby-2.6-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎ruby-2.7-wf]|
|
|
77
|
-
| Support & Community | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼🏫expsup-upwork-img]][👨🏼🏫expsup-upwork] [![Get help from me on Codementor][👨🏼🏫expsup-codementor-img]][👨🏼🏫expsup-codementor] |
|
|
78
|
-
| Source | [![Source on GitLab.com][📜src-gl-img]][📜src-gl] [![Source on CodeBerg.org][📜src-cb-img]][📜src-cb] [![Source on
|
|
78
|
+
| Support & Community | [![Join Me on Daily.dev's RubyFriends][✉️ruby-friends-img]][✉️ruby-friends] [![Get help from RubyForum][✉️ruby-forum-img]][✉️ruby-forum] [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼🏫expsup-upwork-img]][👨🏼🏫expsup-upwork] [![Get help from me on Codementor][👨🏼🏫expsup-codementor-img]][👨🏼🏫expsup-codementor] |
|
|
79
|
+
| Source | [![Source on GitLab.com][📜src-gl-img]][📜src-gl] [![Source on CodeBerg.org][📜src-cb-img]][📜src-cb] [![Source on GitHub.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc] |
|
|
79
80
|
| Documentation | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![GitLab Wiki][📜gl-wiki-img]][📜gl-wiki] [![GitHub Wiki][📜gh-wiki-img]][📜gh-wiki] |
|
|
80
81
|
| Compliance | [![License: MIT][📄license-img]][📄license] [![Apache license compatibility: Category A][📄license-compat-img]][📄license-compat] [![📄ilo-declaration-img]][📄ilo-declaration] [![Security Policy][🔐security-img]][🔐security] [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct] [![SemVer 2.0.0][📌semver-img]][📌semver] |
|
|
81
82
|
| Style | [![Enforced Code Style Linter][💎rlts-img]][💎rlts] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog] [![Gitmoji Commits][📌gitmoji-img]][📌gitmoji] [![Compatibility appraised by: appraisal2][💎appraisal2-img]][💎appraisal2] |
|
|
@@ -84,11 +85,12 @@ The primary maintainer since 2020 is Peter Boling ([@pboling](https://github.com
|
|
|
84
85
|
|
|
85
86
|
### Compatibility
|
|
86
87
|
|
|
87
|
-
|
|
88
|
+
The gem's declared runtime compatibility floor is MRI Ruby 2.3+, with concordant releases of JRuby and TruffleRuby.
|
|
88
89
|
CI workflows and Appraisals are generated for MRI Ruby 2.4+.
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
90
|
+
The current MRI CI lane runs on Linux and macOS.
|
|
91
|
+
The test floor is configured by `ruby.test_minimum` in `.kettle-jem.yml`.
|
|
92
|
+
When it is higher than the runtime floor, older runtime-compatible Rubies are
|
|
93
|
+
not covered by the generated CI or Appraisal matrix.
|
|
92
94
|
|
|
93
95
|
<a href="https://github.com/kettle-dev"><img alt="kettle-dev Logo by Aboling0, CC BY-SA 4.0" src="https://logos.galtzo.com/assets/images/kettle-dev/avatar-128px.svg" width="14%" align="right"/></a>
|
|
94
96
|
|
|
@@ -97,16 +99,16 @@ The _amazing_ test matrix is powered by the kettle-dev stack.
|
|
|
97
99
|
<details markdown="1">
|
|
98
100
|
<summary>How kettle-dev manages complexity in tests</summary>
|
|
99
101
|
|
|
100
|
-
| Gem | Source | Role |
|
|
102
|
+
| Gem | Source | Role | Total downloads |
|
|
101
103
|
|-----|--------|------|---------------------|
|
|
102
|
-
| [appraisal2](https://
|
|
103
|
-
| [appraisal2-rubocop](https://
|
|
104
|
-
| [kettle-dev](https://
|
|
105
|
-
| [kettle-jem](https://
|
|
106
|
-
| [kettle-soup-cover](https://
|
|
107
|
-
| [kettle-test](https://
|
|
108
|
-
| [rubocop-lts](https://
|
|
109
|
-
| [turbo_tests2](https://
|
|
104
|
+
| [appraisal2](https://clickgems.clickhouse.com/dashboard/appraisal2) | [GitHub](https://github.com/appraisal-rb/appraisal2) | multi-dependency Appraisal matrix generation | [](https://clickgems.clickhouse.com/dashboard/appraisal2) |
|
|
105
|
+
| [appraisal2-rubocop](https://clickgems.clickhouse.com/dashboard/appraisal2-rubocop) | [GitHub](https://github.com/appraisal-rb/appraisal2-rubocop) | RuboCop Appraisal generator integration | [](https://clickgems.clickhouse.com/dashboard/appraisal2-rubocop) |
|
|
106
|
+
| [kettle-dev](https://clickgems.clickhouse.com/dashboard/kettle-dev) | [GitHub](https://github.com/kettle-dev/kettle-dev) | development, release, and CI workflow tooling | [](https://clickgems.clickhouse.com/dashboard/kettle-dev) |
|
|
107
|
+
| [kettle-jem](https://clickgems.clickhouse.com/dashboard/kettle-jem) | [GitHub](https://github.com/kettle-dev/kettle-jem) | Appraisals & CI workflow templates | [](https://clickgems.clickhouse.com/dashboard/kettle-jem) |
|
|
108
|
+
| [kettle-soup-cover](https://clickgems.clickhouse.com/dashboard/kettle-soup-cover) | [GitHub](https://github.com/kettle-dev/kettle-soup-cover) | SimpleCov coverage policy and reporting | [](https://clickgems.clickhouse.com/dashboard/kettle-soup-cover) |
|
|
109
|
+
| [kettle-test](https://clickgems.clickhouse.com/dashboard/kettle-test) | [GitHub](https://github.com/kettle-dev/kettle-test) | standard test runner and coverage harness | [](https://clickgems.clickhouse.com/dashboard/kettle-test) |
|
|
110
|
+
| [rubocop-lts](https://clickgems.clickhouse.com/dashboard/rubocop-lts) | [GitHub](https://github.com/rubocop-lts/rubocop-lts) | Ruby-version-aware linting | [](https://clickgems.clickhouse.com/dashboard/rubocop-lts) |
|
|
111
|
+
| [turbo_tests2](https://clickgems.clickhouse.com/dashboard/turbo_tests2) | [GitHub](https://github.com/galtzo-floss/turbo_tests2) | parallel test execution | [](https://clickgems.clickhouse.com/dashboard/turbo_tests2) |
|
|
110
112
|
|
|
111
113
|
</details>
|
|
112
114
|
|
|
@@ -115,39 +117,22 @@ The _amazing_ test matrix is powered by the kettle-dev stack.
|
|
|
115
117
|
<details markdown="1">
|
|
116
118
|
<summary>Find this repo on federated forges (Coming soon!)</summary>
|
|
117
119
|
|
|
118
|
-
| Federated [DVCS][💎d-in-dvcs] Repository | Status | Issues | PRs | Wiki | CI |
|
|
119
|
-
|
|
120
|
-
| 🧪 [ruby-oauth/oauth on GitLab][📜src-gl] | The Truth | [💚][🤝gl-issues] | [💚][🤝gl-pulls] | [💚][📜gl-wiki] | 🐭 Tiny Matrix |
|
|
121
|
-
| 🧊 [ruby-oauth/oauth on CodeBerg][📜src-cb] | An Ethical Mirror ([Donate][🤝cb-donate]) | [💚][🤝cb-issues] | [💚][🤝cb-pulls] | ➖ | ⭕️ No Matrix |
|
|
122
|
-
| 🐙 [ruby-oauth/oauth on GitHub][📜src-gh] | Another Mirror | [💚][🤝gh-issues] | [💚][🤝gh-pulls] | [💚][📜gh-wiki] | 💯 Full Matrix |
|
|
123
|
-
| 🎮️ [Discord Server][✉️discord-invite] | [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] | [Let's][✉️discord-invite] | [talk][✉️discord-invite] | [about][✉️discord-invite] | [this][✉️discord-invite] | [library!][✉️discord-invite] |
|
|
120
|
+
| Federated [DVCS][💎d-in-dvcs] Repository | Status | Issues | PRs | Wiki | CI |
|
|
121
|
+
|-------------------------------------------------|-------------------------------------------|-------------------|------------------|-----------------|----------------|
|
|
122
|
+
| 🧪 [ruby-oauth/oauth on GitLab][📜src-gl] | The Truth | [💚][🤝gl-issues] | [💚][🤝gl-pulls] | [💚][📜gl-wiki] | 🐭 Tiny Matrix |
|
|
123
|
+
| 🧊 [ruby-oauth/oauth on CodeBerg][📜src-cb] | An Ethical Mirror ([Donate][🤝cb-donate]) | [💚][🤝cb-issues] | [💚][🤝cb-pulls] | ➖ | ⭕️ No Matrix |
|
|
124
|
+
| 🐙 [ruby-oauth/oauth on GitHub][📜src-gh] | Another Mirror | [💚][🤝gh-issues] | [💚][🤝gh-pulls] | [💚][📜gh-wiki] | 💯 Full Matrix |
|
|
124
125
|
|
|
125
126
|
</details>
|
|
126
127
|
|
|
127
|
-
|
|
128
|
+
### Enterprise Support
|
|
128
129
|
|
|
129
|
-
|
|
130
|
+
For enterprise support from the maintainer, use [Upwork][👨🏼🏫expsup-upwork] or [CodeMentor][👨🏼🏫expsup-codementor].
|
|
130
131
|
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
<details markdown="1">
|
|
134
|
-
<summary>Need enterprise-level guarantees?</summary>
|
|
135
|
-
|
|
136
|
-
The maintainers of this and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use.
|
|
137
|
-
|
|
138
|
-
[![Get help from me on Tidelift][🏙️entsup-tidelift-img]][🏙️entsup-tidelift]
|
|
139
|
-
|
|
140
|
-
- 💡Subscribe for support guarantees covering _all_ your FLOSS dependencies
|
|
141
|
-
- 💡Tidelift is part of [Sonar][🏙️entsup-tidelift-sonar]
|
|
142
|
-
- 💡Tidelift pays maintainers to maintain the software you depend on!<br/>📊`@`Pointy Haired Boss: An [enterprise support][🏙️entsup-tidelift] subscription is "[never gonna let you down][🧮kloc]", and *supports* open source maintainers
|
|
143
|
-
|
|
144
|
-
Alternatively:
|
|
132
|
+
Other support channels:
|
|
145
133
|
|
|
134
|
+
- [![Ruby Users Forum][✉️ruby-forum-img]][✉️ruby-forum]
|
|
146
135
|
- [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite]
|
|
147
|
-
- [![Get help from me on Upwork][👨🏼🏫expsup-upwork-img]][👨🏼🏫expsup-upwork]
|
|
148
|
-
- [![Get help from me on Codementor][👨🏼🏫expsup-codementor-img]][👨🏼🏫expsup-codementor]
|
|
149
|
-
|
|
150
|
-
</details>
|
|
151
136
|
|
|
152
137
|
## ✨ Installation
|
|
153
138
|
|
|
@@ -182,6 +167,7 @@ Common options include:
|
|
|
182
167
|
- `:ca_file`, `:proxy`, `:debug_output` - Net::HTTP transport options.
|
|
183
168
|
- `:token_request_max_redirects` - Maximum redirects followed while requesting OAuth tokens. Defaults to `10`.
|
|
184
169
|
- `:token_request_cross_origin_redirects` - Whether token requests may follow redirects to a different scheme, host, or effective port. Defaults to `false`; only enable this when the provider's token endpoints intentionally redirect across origins.
|
|
170
|
+
- `:access_token_cross_origin_requests` - Whether `AccessToken` service calls (`#get`/`#post`/`#put`/`#patch`/`#delete`/`#head`) may target an absolute URI whose origin (scheme, host, or effective port) differs from `:site`. Defaults to `false`; a cross-origin absolute URI raises `OAuth::Error` because it would send the signed OAuth `Authorization` header to a different host (credential leak / SSRF). Enable this only when you intentionally call signed service endpoints on other origins, and never pass untrusted/user-supplied URLs to these methods.
|
|
185
171
|
|
|
186
172
|
This gem was originally extracted from @pelle's [oauth-plugin](https://github.com/pelle/oauth-plugin)
|
|
187
173
|
gem. After extraction that gem was made to depend on this gem.
|
|
@@ -282,19 +268,20 @@ We welcome both individual and corporate sponsors! We also offer a
|
|
|
282
268
|
wide array of funding channels to account for your preferences.
|
|
283
269
|
Currently, [Open Collective][🖇osc] is our preferred funding platform.
|
|
284
270
|
|
|
271
|
+
### Corporate Sponsorship
|
|
272
|
+
|
|
273
|
+
- <a href="https://serpapi.com"><img alt="SerpApi" src="https://serpapi.com/assets/media_kit/logo-with-wordmark.svg" height="32"/></a> [SerpApi](https://serpapi.com)
|
|
274
|
+
|
|
285
275
|
**If you're working in a company that's making significant use of ruby-oauth tools we'd
|
|
286
276
|
appreciate it if you suggest to your company to become a ruby-oauth sponsor.**
|
|
287
277
|
|
|
278
|
+
### Individual Support
|
|
279
|
+
|
|
288
280
|
You can support the development of ruby-oauth tools via
|
|
289
281
|
[GitHub Sponsors][🖇sponsor],
|
|
290
282
|
[Liberapay][⛳liberapay],
|
|
291
|
-
[
|
|
292
|
-
[
|
|
293
|
-
and [Tidelift][🏙️entsup-tidelift].
|
|
294
|
-
|
|
295
|
-
| 📍 NOTE |
|
|
296
|
-
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
297
|
-
| If doing a sponsorship in the form of donation is problematic for your company <br/> from an accounting standpoint, we'd recommend the use of Tidelift, <br/> where you can get a support-like subscription instead. |
|
|
283
|
+
[Open Collective][🖇osc],
|
|
284
|
+
and [PayPal][🖇paypal].
|
|
298
285
|
|
|
299
286
|
### Open Collective for Individuals
|
|
300
287
|
|
|
@@ -314,10 +301,6 @@ NOTE: [kettle-readme-backers][kettle-readme-backers] updates this list every day
|
|
|
314
301
|
|
|
315
302
|
<!-- OPENCOLLECTIVE-ORGANIZATIONS:START -->
|
|
316
303
|
No sponsors yet. Be the first!
|
|
317
|
-
|
|
318
|
-
### Open Collective for Donors
|
|
319
|
-
|
|
320
|
-
[Bill Woika](https://opencollective.com/bill-woika) [Philipp Ebneter](https://opencollective.com/guest-e77282f7) [Grigoriy](https://opencollective.com/guest-c93e0c48)
|
|
321
304
|
<!-- OPENCOLLECTIVE-ORGANIZATIONS:END -->
|
|
322
305
|
|
|
323
306
|
[kettle-readme-backers]: https://github.com/ruby-oauth/oauth/blob/main/bin/kettle-readme-backers
|
|
@@ -341,8 +324,7 @@ See [SECURITY.md][🔐security].
|
|
|
341
324
|
## 🤝 Contributing
|
|
342
325
|
|
|
343
326
|
If you need some ideas of where to help, you could work on adding more code coverage,
|
|
344
|
-
|
|
345
|
-
or use the gem and think about how it could be better.
|
|
327
|
+
check [issues][🤝gh-issues] or [PRs][🤝gh-pulls], or use the gem and think about how it could be better.
|
|
346
328
|
|
|
347
329
|
We [![Keep A Changelog][📗keep-changelog-img]][📗keep-changelog] so if you make changes, remember to update it.
|
|
348
330
|
|
|
@@ -381,11 +363,11 @@ Also see GitLab Contributors: [https://gitlab.com/ruby-oauth/oauth/-/graphs/main
|
|
|
381
363
|
<details markdown="1">
|
|
382
364
|
<summary>⭐️ Star History</summary>
|
|
383
365
|
|
|
384
|
-
<a href="https://star-history.
|
|
366
|
+
<a href="https://star-history.dera.page/#ruby-oauth/oauth&type=date&legend=top-left">
|
|
385
367
|
<picture>
|
|
386
|
-
<source media="(prefers-color-scheme: dark)" srcset="https://
|
|
387
|
-
<source media="(prefers-color-scheme: light)" srcset="https://
|
|
388
|
-
<img alt="Star History Chart" src="https://
|
|
368
|
+
<source media="(prefers-color-scheme: dark)" srcset="https://star-history.dera.page/svg?repos=ruby-oauth/oauth&type=date&theme=dark&legend=top-left" />
|
|
369
|
+
<source media="(prefers-color-scheme: light)" srcset="https://star-history.dera.page/svg?repos=ruby-oauth/oauth&type=date&legend=top-left" />
|
|
370
|
+
<img alt="Star History Chart" src="https://star-history.dera.page/svg?repos=ruby-oauth/oauth&type=date&legend=top-left" />
|
|
389
371
|
</picture>
|
|
390
372
|
</a>
|
|
391
373
|
|
|
@@ -420,7 +402,7 @@ See [CHANGELOG.md][📌changelog] for a list of releases.
|
|
|
420
402
|
## 📄 License
|
|
421
403
|
|
|
422
404
|
The gem is available as open source under the terms of
|
|
423
|
-
the [MIT](MIT.md) [![License: MIT][📄license-img]][📄license-ref].
|
|
405
|
+
the [MIT](https://github.com/ruby-oauth/oauth/blob/main/MIT.md) [![License: MIT][📄license-img]][📄license-ref].
|
|
424
406
|
|
|
425
407
|
### © Copyright
|
|
426
408
|
|
|
@@ -481,16 +463,15 @@ See [LICENSE.md][📄license] for the official copyright notice.
|
|
|
481
463
|
- Copyright (c) 2019 Shohei Maeda
|
|
482
464
|
- Copyright (c) 2020-2021, 2026 Khem
|
|
483
465
|
- Copyright (c) 2021 Chuck Remes
|
|
484
|
-
- Copyright (c) 2021 iamibi
|
|
466
|
+
- Copyright (c) 2021, 2026 iamibi
|
|
485
467
|
- Copyright (c) 2021 Jeremy Sioui
|
|
486
468
|
- Copyright (c) 2021 Nick Morgan
|
|
487
469
|
- Copyright (c) 2021-2022, 2025-2026 Peter H. Boling
|
|
488
470
|
- Copyright (c) 2021 Richard Vowles
|
|
489
471
|
- Copyright (c) 2022 Shalvah
|
|
490
472
|
- Copyright (c) 2024-2025 Annibelle Boling
|
|
491
|
-
- Copyright (c) 2025 Aboling0
|
|
492
473
|
- Copyright (c) 2026 David Varga
|
|
493
|
-
- Copyright (c) 2026
|
|
474
|
+
- Copyright (c) 2026 Richard Desmarais
|
|
494
475
|
|
|
495
476
|
</details>
|
|
496
477
|
|
|
@@ -503,11 +484,12 @@ I'm hoping to be able to pay for my kids' health insurance this month,
|
|
|
503
484
|
so if you value the work I am doing, I need your support.
|
|
504
485
|
Please consider sponsoring me or the project.
|
|
505
486
|
|
|
506
|
-
To join the community or get help
|
|
487
|
+
To join the community or get help, use the RubyForum or Discord.
|
|
507
488
|
|
|
489
|
+
[![Ruby Users Forum][✉️ruby-forum-img]][✉️ruby-forum]
|
|
508
490
|
[![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite]
|
|
509
491
|
|
|
510
|
-
To say "thanks!" ☝️ Join the
|
|
492
|
+
To say "thanks!" ☝️ Join the community or 👇️ send money.
|
|
511
493
|
|
|
512
494
|
[![Sponsor ruby-oauth/oauth on Open Source Collective][🖇osc-all-bottom-img]][🖇osc] 💌 [![Sponsor me on GitHub Sponsors][🖇sponsor-bottom-img]][🖇sponsor] 💌 [![Sponsor me on Liberapay][⛳liberapay-bottom-img]][⛳liberapay] 💌 [![Donate on PayPal][🖇paypal-bottom-img]][🖇paypal]
|
|
513
495
|
|
|
@@ -548,11 +530,14 @@ Thanks for RTFM. ☺️
|
|
|
548
530
|
[✉️discord-invite-img-ftb]: https://img.shields.io/discord/1373797679469170758?style=for-the-badge&logo=discord
|
|
549
531
|
[✉️ruby-friends-img]: https://img.shields.io/badge/daily.dev-%F0%9F%92%8E_Ruby_Friends-0A0A0A?style=for-the-badge&logo=dailydotdev&logoColor=white
|
|
550
532
|
[✉️ruby-friends]: https://app.daily.dev/squads/rubyfriends
|
|
533
|
+
[✉️ruby-forum-top-img]: https://img.shields.io/discourse/topics?server=https%3A%2F%2Fwww.rubyforum.org&style=flat&logo=discourse&label=Ruby%20Users%20Forum
|
|
534
|
+
[✉️ruby-forum-img]: https://img.shields.io/discourse/topics?server=https%3A%2F%2Fwww.rubyforum.org&style=for-the-badge&logo=discourse&label=Ruby%20Users%20Forum
|
|
535
|
+
[✉️ruby-forum]: https://www.rubyforum.org/tag/oauth
|
|
551
536
|
|
|
552
537
|
[✇bundle-group-pattern]: https://gist.github.com/pboling/4564780
|
|
553
538
|
[⛳️gem-namespace]: https://github.com/ruby-oauth/oauth
|
|
554
539
|
[⛳️namespace-img]: https://img.shields.io/badge/namespace-OAuth-3C2D2D.svg?style=square&logo=ruby&logoColor=white
|
|
555
|
-
[⛳️gem-name]: https://
|
|
540
|
+
[⛳️gem-name]: https://clickgems.clickhouse.com/dashboard/oauth
|
|
556
541
|
[⛳️name-img]: https://img.shields.io/badge/name-oauth-3C2D2D.svg?style=square&logo=rubygems&logoColor=red
|
|
557
542
|
[⛳️tag-img]: https://img.shields.io/github/tag/ruby-oauth/oauth.svg
|
|
558
543
|
[⛳️tag]: https://github.com/ruby-oauth/oauth/releases
|
|
@@ -584,16 +569,13 @@ Thanks for RTFM. ☺️
|
|
|
584
569
|
[👨🏼🏫expsup-upwork-img]: https://img.shields.io/badge/UpWork-13544E?style=for-the-badge&logo=Upwork&logoColor=white
|
|
585
570
|
[👨🏼🏫expsup-codementor]: https://www.codementor.io/peterboling?utm_source=github&utm_medium=button&utm_term=peterboling&utm_campaign=github
|
|
586
571
|
[👨🏼🏫expsup-codementor-img]: https://img.shields.io/badge/CodeMentor-Get_Help-1abc9c?style=for-the-badge&logo=CodeMentor&logoColor=white
|
|
587
|
-
[🏙️entsup-tidelift]: https://tidelift.com/subscription/pkg/rubygems-oauth?utm_source=rubygems-oauth&utm_medium=referral&utm_campaign=readme
|
|
588
|
-
[🏙️entsup-tidelift-img]: https://img.shields.io/badge/Tidelift_and_Sonar-Enterprise_Support-FD3456?style=for-the-badge&logo=sonar&logoColor=white
|
|
589
|
-
[🏙️entsup-tidelift-sonar]: https://blog.tidelift.com/tidelift-joins-sonar
|
|
590
572
|
[💁🏼♂️peterboling]: http://www.peterboling.com
|
|
591
573
|
[🚂railsbling]: http://www.railsbling.com
|
|
592
574
|
[📜src-gl-img]: https://img.shields.io/badge/GitLab-FBA326?style=for-the-badge&logo=Gitlab&logoColor=orange
|
|
593
575
|
[📜src-gl]: https://gitlab.com/ruby-oauth/oauth
|
|
594
576
|
[📜src-cb-img]: https://img.shields.io/badge/CodeBerg-4893CC?style=for-the-badge&logo=CodeBerg&logoColor=blue
|
|
595
577
|
[📜src-cb]: https://codeberg.org/ruby-oauth/oauth
|
|
596
|
-
[📜src-gh-img]: https://img.shields.io/badge/GitHub-238636?style=for-the-badge&logo=
|
|
578
|
+
[📜src-gh-img]: https://img.shields.io/badge/GitHub-238636?style=for-the-badge&logo=GitHub&logoColor=green
|
|
597
579
|
[📜src-gh]: https://github.com/ruby-oauth/oauth
|
|
598
580
|
[📜docs-cr-rd-img]: https://img.shields.io/badge/RubyDoc-Current_Release-943CD2?style=for-the-badge&logo=readthedocs&logoColor=white
|
|
599
581
|
[📜docs-head-rd-img]: https://img.shields.io/badge/YARD_on_Galtzo.com-HEAD-943CD2?style=for-the-badge&logo=readthedocs&logoColor=white
|
|
@@ -601,9 +583,9 @@ Thanks for RTFM. ☺️
|
|
|
601
583
|
[📜gh-wiki]: https://github.com/ruby-oauth/oauth/wiki
|
|
602
584
|
[📜gl-wiki-img]: https://img.shields.io/badge/wiki-gitlab-943CD2.svg?style=for-the-badge&logo=gitlab&logoColor=white
|
|
603
585
|
[📜gh-wiki-img]: https://img.shields.io/badge/wiki-github-943CD2.svg?style=for-the-badge&logo=github&logoColor=white
|
|
604
|
-
[👽dl-rank]: https://
|
|
605
|
-
[👽dl-ranki]: https://img.shields.io/gem/
|
|
606
|
-
[👽version]: https://
|
|
586
|
+
[👽dl-rank]: https://clickgems.clickhouse.com/dashboard/oauth
|
|
587
|
+
[👽dl-ranki]: https://img.shields.io/gem/dt/oauth.svg
|
|
588
|
+
[👽version]: https://clickgems.clickhouse.com/dashboard/oauth
|
|
607
589
|
[👽versioni]: https://img.shields.io/gem/v/oauth.svg
|
|
608
590
|
[🏀qlty-mnt]: https://qlty.sh/gh/ruby-oauth/projects/oauth
|
|
609
591
|
[🏀qlty-mnti]: https://qlty.sh/gh/ruby-oauth/projects/oauth/maintainability.svg
|
|
@@ -627,7 +609,6 @@ Thanks for RTFM. ☺️
|
|
|
627
609
|
[🚎jruby-9.4-wf]: https://github.com/ruby-oauth/oauth/actions/workflows/jruby-9.4.yml
|
|
628
610
|
[🚎jruby-10.0-wf]: https://github.com/ruby-oauth/oauth/actions/workflows/jruby-10.0.yml
|
|
629
611
|
[🚎truby-22.3-wf]: https://github.com/ruby-oauth/oauth/actions/workflows/truffleruby-22.3.yml
|
|
630
|
-
[🚎truby-23.0-wf]: https://github.com/ruby-oauth/oauth/actions/workflows/truffleruby-23.0.yml
|
|
631
612
|
[🚎truby-23.1-wf]: https://github.com/ruby-oauth/oauth/actions/workflows/truffleruby-23.1.yml
|
|
632
613
|
[🚎truby-24.2-wf]: https://github.com/ruby-oauth/oauth/actions/workflows/truffleruby-24.2.yml
|
|
633
614
|
[🚎truby-25.0-wf]: https://github.com/ruby-oauth/oauth/actions/workflows/truffleruby-25.0.yml
|
|
@@ -665,13 +646,11 @@ Thanks for RTFM. ☺️
|
|
|
665
646
|
[💎ruby-c-i]: https://img.shields.io/badge/Ruby-current-CC342D?style=for-the-badge&logo=ruby&logoColor=green
|
|
666
647
|
[💎ruby-headi]: https://img.shields.io/badge/Ruby-HEAD-CC342D?style=for-the-badge&logo=ruby&logoColor=blue
|
|
667
648
|
[💎truby-22.3i]: https://img.shields.io/badge/Truffle_Ruby-22.3-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
|
|
668
|
-
[💎truby-23.0i]: https://img.shields.io/badge/Truffle_Ruby-23.0-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
|
|
669
649
|
[💎truby-23.1i]: https://img.shields.io/badge/Truffle_Ruby-23.1-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
|
|
670
650
|
[💎truby-24.2i]: https://img.shields.io/badge/Truffle_Ruby-24.2-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
|
|
671
651
|
[💎truby-25.0i]: https://img.shields.io/badge/Truffle_Ruby-25.0-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
|
|
672
652
|
[💎truby-33.0i]: https://img.shields.io/badge/Truffle_Ruby-33.0-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
|
|
673
653
|
[💎truby-c-i]: https://img.shields.io/badge/Truffle_Ruby-current-34BCB1?style=for-the-badge&logo=ruby&logoColor=green
|
|
674
|
-
[💎truby-headi]: https://img.shields.io/badge/Truffle_Ruby-HEAD-34BCB1?style=for-the-badge&logo=ruby&logoColor=blue
|
|
675
654
|
[💎jruby-9.2i]: https://img.shields.io/badge/JRuby-9.2-FBE742?style=for-the-badge&logo=ruby&logoColor=red
|
|
676
655
|
[💎jruby-9.3i]: https://img.shields.io/badge/JRuby-9.3-FBE742?style=for-the-badge&logo=ruby&logoColor=red
|
|
677
656
|
[💎jruby-9.4i]: https://img.shields.io/badge/JRuby-9.4-FBE742?style=for-the-badge&logo=ruby&logoColor=red
|
|
@@ -704,12 +683,12 @@ Thanks for RTFM. ☺️
|
|
|
704
683
|
[📌gitmoji]: https://gitmoji.dev
|
|
705
684
|
[📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
|
|
706
685
|
[🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
|
|
707
|
-
[🧮kloc-img]: https://img.shields.io/badge/KLOC-
|
|
686
|
+
[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.979-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
|
|
708
687
|
[🔐security]: https://github.com/ruby-oauth/oauth/blob/main/SECURITY.md
|
|
709
688
|
[🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
|
|
710
689
|
[📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year
|
|
711
690
|
[📄license]: LICENSE.md
|
|
712
|
-
[📄license-ref]: MIT.md
|
|
691
|
+
[📄license-ref]: https://github.com/ruby-oauth/oauth/blob/main/MIT.md
|
|
713
692
|
[📄license-img]: https://img.shields.io/badge/License-MIT-259D6C.svg
|
|
714
693
|
[📄license-compat]: https://www.apache.org/legal/resolved.html#category-a
|
|
715
694
|
[📄license-compat-img]: https://img.shields.io/badge/Apache_Compatible:_Category_A-%E2%9C%93-259D6C.svg?style=flat&logo=Apache
|
|
@@ -730,9 +709,9 @@ Thanks for RTFM. ☺️
|
|
|
730
709
|
| Field | Value |
|
|
731
710
|
|---|---|
|
|
732
711
|
| Package | oauth |
|
|
733
|
-
| Description |
|
|
712
|
+
| Description | 🔑 A Ruby wrapper for the original OAuth 1.0 / 1.0a spec. |
|
|
734
713
|
| Homepage | https://github.com/ruby-oauth/oauth |
|
|
735
714
|
| Source | https://github.com/ruby-oauth/oauth |
|
|
736
715
|
| License | `MIT` |
|
|
737
|
-
| Funding | https://github.com/sponsors/pboling, https://ko-fi.com/pboling, https://liberapay.com/pboling/donate, https://opencollective.com/ruby-oauth, https://thanks.dev/u/gh/pboling, https://
|
|
716
|
+
| Funding | https://github.com/sponsors/pboling, https://ko-fi.com/pboling, https://liberapay.com/pboling/donate, https://opencollective.com/ruby-oauth, https://thanks.dev/u/gh/pboling, https://www.buymeacoffee.com/pboling |
|
|
738
717
|
<!-- kettle-jem:metadata:end -->
|
data/lib/oauth/consumer.rb
CHANGED
|
@@ -94,7 +94,15 @@ module OAuth
|
|
|
94
94
|
# default. Cross-origin redirects can re-sign token requests for an
|
|
95
95
|
# attacker-controlled endpoint, so they require explicit opt-in.
|
|
96
96
|
token_request_max_redirects: 10,
|
|
97
|
-
token_request_cross_origin_redirects: false
|
|
97
|
+
token_request_cross_origin_redirects: false,
|
|
98
|
+
|
|
99
|
+
# AccessToken service calls (AccessToken#get/#post/...) may target an
|
|
100
|
+
# absolute URI. By default such a call is permitted only when it shares
|
|
101
|
+
# the configured site's origin (scheme, host, and port); a cross-origin
|
|
102
|
+
# absolute URI raises OAuth::Error, since it would send the signed OAuth
|
|
103
|
+
# Authorization header to a different host (credential leak / SSRF). Set
|
|
104
|
+
# this to true to allow calling service endpoints on other origins.
|
|
105
|
+
access_token_cross_origin_requests: false
|
|
98
106
|
}
|
|
99
107
|
)
|
|
100
108
|
|
|
@@ -142,6 +150,7 @@ module OAuth
|
|
|
142
150
|
def debug_output
|
|
143
151
|
@debug_output ||= case @options[:debug_output]
|
|
144
152
|
when nil, false
|
|
153
|
+
nil
|
|
145
154
|
when true
|
|
146
155
|
$stdout
|
|
147
156
|
else
|
|
@@ -372,12 +381,25 @@ module OAuth
|
|
|
372
381
|
end
|
|
373
382
|
|
|
374
383
|
def token_request_cross_origin?(current_uri, redirected_uri)
|
|
375
|
-
current_uri
|
|
376
|
-
current_uri.host.to_s.downcase != redirected_uri.host.to_s.downcase ||
|
|
377
|
-
token_request_effective_port(current_uri) != token_request_effective_port(redirected_uri)
|
|
384
|
+
cross_origin?(current_uri, redirected_uri)
|
|
378
385
|
end
|
|
379
386
|
|
|
380
|
-
|
|
387
|
+
# Whether the consumer permits AccessToken service calls to an absolute URI
|
|
388
|
+
# whose origin differs from the configured site. Off by default.
|
|
389
|
+
def access_token_cross_origin_requests?
|
|
390
|
+
!!options[:access_token_cross_origin_requests]
|
|
391
|
+
end
|
|
392
|
+
|
|
393
|
+
# True when the two URIs differ in scheme, host, or effective port. Used
|
|
394
|
+
# both for token-request redirect safety and for AccessToken service-call
|
|
395
|
+
# origin checks.
|
|
396
|
+
def cross_origin?(uri_a, uri_b)
|
|
397
|
+
uri_a.scheme.to_s.downcase != uri_b.scheme.to_s.downcase ||
|
|
398
|
+
uri_a.host.to_s.downcase != uri_b.host.to_s.downcase ||
|
|
399
|
+
effective_port(uri_a) != effective_port(uri_b)
|
|
400
|
+
end
|
|
401
|
+
|
|
402
|
+
def effective_port(uri)
|
|
381
403
|
return uri.port if uri.port
|
|
382
404
|
return 443 if uri.scheme == "https"
|
|
383
405
|
|
|
@@ -1,5 +1,7 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
|
|
3
|
+
require "oauth/errors"
|
|
4
|
+
|
|
3
5
|
module OAuth
|
|
4
6
|
# The Access Token is used for the actual "real" web service calls that you perform against the server
|
|
5
7
|
class AccessToken < ConsumerToken
|
|
@@ -9,6 +11,14 @@ module OAuth
|
|
|
9
11
|
request_uri = URI.parse(path)
|
|
10
12
|
site_uri = consumer.uri
|
|
11
13
|
is_service_uri_different = request_uri.absolute? && request_uri != site_uri
|
|
14
|
+
if is_service_uri_different && consumer.cross_origin?(site_uri, request_uri) &&
|
|
15
|
+
!consumer.access_token_cross_origin_requests?
|
|
16
|
+
raise OAuth::Error,
|
|
17
|
+
"AccessToken request to cross-origin URI #{authority(request_uri)} is not permitted " \
|
|
18
|
+
"(configured site origin is #{authority(site_uri)}). Sending the signed OAuth Authorization " \
|
|
19
|
+
"header to a different origin can leak it or enable SSRF. Set the consumer option " \
|
|
20
|
+
"access_token_cross_origin_requests: true to allow service calls to other origins."
|
|
21
|
+
end
|
|
12
22
|
begin
|
|
13
23
|
consumer.uri(request_uri) if is_service_uri_different
|
|
14
24
|
@response = super
|
|
@@ -81,5 +91,13 @@ module OAuth
|
|
|
81
91
|
def delete(path, headers = {})
|
|
82
92
|
request(:delete, path, headers)
|
|
83
93
|
end
|
|
94
|
+
|
|
95
|
+
private
|
|
96
|
+
|
|
97
|
+
# scheme://host[:port] for an error message; URI::HTTP/HTTPS always
|
|
98
|
+
# resolve a port, so it renders whenever one is known.
|
|
99
|
+
def authority(uri)
|
|
100
|
+
"#{uri.scheme}://#{uri.host}#{":#{uri.port}" if uri.port}"
|
|
101
|
+
end
|
|
84
102
|
end
|
|
85
103
|
end
|