oauth2 2.0.13 → 2.0.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- checksums.yaml.gz.sig +0 -0
- data/CHANGELOG.md +145 -103
- data/OIDC.md +158 -0
- data/README.md +350 -80
- data/lib/oauth2/access_token.rb +2 -0
- data/lib/oauth2/client.rb +4 -0
- data/lib/oauth2/strategy/auth_code.rb +10 -0
- data/lib/oauth2/strategy/implicit.rb +8 -0
- data/lib/oauth2/strategy/password.rb +8 -0
- data/lib/oauth2/version.rb +1 -1
- data.tar.gz.sig +0 -0
- metadata +11 -9
- metadata.gz.sig +0 -0
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 13b8d56f68c6dae03cbb3313aecb30978d9a117e7c91e309348719457311aed7
|
|
4
|
+
data.tar.gz: 025577c1281bccd732da31fed3afe3441df27756d034795fad92eca8fd145d74
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 7613aac3b16430f7c1631f951ab1781fff833712b5e919b6a98208019e6d9fd441693b7632d618de373cadc9b5a540213f57f37efc3153d65a1e076062065899
|
|
7
|
+
data.tar.gz: 8dc846f69cb0f8ad230759ab53a0ee6f5a68a1dd11f0948c7de3a6ffe858b15fb4d46f5120329c6398883c751d79caba391e37c29a7c067f7864e0fa9ae6f323
|
checksums.yaml.gz.sig
CHANGED
|
Binary file
|
data/CHANGELOG.md
CHANGED
|
@@ -1,8 +1,20 @@
|
|
|
1
1
|
# Changelog
|
|
2
|
+
|
|
3
|
+
[![SemVer 2.0.0][📌semver-img]][📌semver] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog]
|
|
4
|
+
|
|
2
5
|
All notable changes to this project will be documented in this file.
|
|
3
6
|
|
|
4
|
-
The format
|
|
5
|
-
and this project adheres to [Semantic Versioning
|
|
7
|
+
The format is based on [Keep a Changelog][📗keep-changelog],
|
|
8
|
+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
|
|
9
|
+
and [yes][📌major-versions-not-sacred], platform and engine support are part of the [public API][📌semver-breaking].
|
|
10
|
+
Please file a bug if you notice a violation of semantic versioning.
|
|
11
|
+
|
|
12
|
+
[📌semver]: https://semver.org/spec/v2.0.0.html
|
|
13
|
+
[📌semver-img]: https://img.shields.io/badge/semver-2.0.0-FFDD67.svg?style=flat
|
|
14
|
+
[📌semver-breaking]: https://github.com/semver/semver/issues/716#issuecomment-869336139
|
|
15
|
+
[📌major-versions-not-sacred]: https://tom.preston-werner.com/2022/05/23/major-version-numbers-are-not-sacred.html
|
|
16
|
+
[📗keep-changelog]: https://keepachangelog.com/en/1.0.0/
|
|
17
|
+
[📗keep-changelog-img]: https://img.shields.io/badge/keep--a--changelog-1.0.0-FFDD67.svg?style=flat
|
|
6
18
|
|
|
7
19
|
## [Unreleased]
|
|
8
20
|
### Added
|
|
@@ -12,6 +24,33 @@ and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.
|
|
|
12
24
|
### Fixed
|
|
13
25
|
### Security
|
|
14
26
|
|
|
27
|
+
## [2.0.14] - 2025-08-31
|
|
28
|
+
- TAG: [v2.0.14][2.0.14t]
|
|
29
|
+
- COVERAGE: 100.00% -- 519/519 lines in 14 files
|
|
30
|
+
- BRANCH COVERAGE: 100.00% -- 174/174 branches in 14 files
|
|
31
|
+
- 90.48% documented
|
|
32
|
+
### Added
|
|
33
|
+
- improved documentation by @pboling
|
|
34
|
+
- [gh665][gh665] - Document Mutual TLS (mTLS) usage with example in README (connection_opts.ssl client_cert/client_key and auth_scheme: :tls_client_auth) by @pboling
|
|
35
|
+
- [gh666][gh666] - Document usage of flat query params using Faraday::FlatParamsEncoder, with example URI, in README by @pboling
|
|
36
|
+
- Spec: verify flat params are preserved with Faraday::FlatParamsEncoder (skips on Faraday without FlatParamsEncoder)
|
|
37
|
+
- [gh662][gh662] - documentation notes in code comments and README highlighting OAuth 2.1 differences, with references, such as: by @pboling
|
|
38
|
+
- PKCE required for auth code,
|
|
39
|
+
- exact redirect URI match,
|
|
40
|
+
- implicit/password grants omitted,
|
|
41
|
+
- avoid bearer tokens in query,
|
|
42
|
+
- refresh token guidance for public clients,
|
|
43
|
+
- simplified client definitions)
|
|
44
|
+
- [gh663][gh663] - document how to implement an OIDC client with this gem in OIDC.md by @pboling
|
|
45
|
+
- also, list libraries built on top of the oauth2 gem that implement OIDC
|
|
46
|
+
- [gh664][gh664] - README: Add example for JHipster UAA (Spring Cloud) password grant, converted from Postman/Net::HTTP by @pboling
|
|
47
|
+
|
|
48
|
+
[gh662]: https://github.com/ruby-oauth/oauth2/pull/662
|
|
49
|
+
[gh663]: https://github.com/ruby-oauth/oauth2/pull/663
|
|
50
|
+
[gh664]: https://github.com/ruby-oauth/oauth2/pull/664
|
|
51
|
+
[gh665]: https://github.com/ruby-oauth/oauth2/pull/665
|
|
52
|
+
[gh666]: https://github.com/ruby-oauth/oauth2/pull/666
|
|
53
|
+
|
|
15
54
|
## [2.0.13] - 2025-08-30
|
|
16
55
|
- TAG: [v2.0.13][2.0.13t]
|
|
17
56
|
- COVERAGE: 100.00% -- 519/519 lines in 14 files
|
|
@@ -24,6 +63,7 @@ and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.
|
|
|
24
63
|
- [gh660][gh660]- (more) Comprehensive documentation / examples by @pboling
|
|
25
64
|
- [gh657][gh657] - Updated documentation for org-rename by @pboling
|
|
26
65
|
- More funding links by @Aboling0
|
|
66
|
+
- Documentation: Added docs/OIDC.md with OIDC 1.0 overview, example, and references
|
|
27
67
|
### Changed
|
|
28
68
|
- Upgrade Code of Conduct to Contributor Covenant 2.1 by @pboling
|
|
29
69
|
- [gh660][gh660] - Shrink post-install message by 4 lines by @pboling
|
|
@@ -600,106 +640,108 @@ and this project adheres to [Semantic Versioning v2](https://semver.org/spec/v2.
|
|
|
600
640
|
|
|
601
641
|
[gemfiles/readme]: gemfiles/README.md
|
|
602
642
|
|
|
603
|
-
[Unreleased]: https://
|
|
604
|
-
[
|
|
605
|
-
[
|
|
606
|
-
[0.0.2]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.1...v0.0.2
|
|
607
|
-
[0.0.2t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.2
|
|
608
|
-
[0.0.3]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.2...v0.0.3
|
|
609
|
-
[0.0.3t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.3
|
|
610
|
-
[0.0.4]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.3...v0.0.4
|
|
611
|
-
[0.0.4t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.4
|
|
612
|
-
[0.0.5]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.4...v0.0.5
|
|
613
|
-
[0.0.5t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.5
|
|
614
|
-
[0.0.6]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.5...v0.0.6
|
|
615
|
-
[0.0.6t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.6
|
|
616
|
-
[0.0.7]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.6...v0.0.7
|
|
617
|
-
[0.0.7t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.7
|
|
618
|
-
[0.0.8]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.7...v0.0.8
|
|
619
|
-
[0.0.8t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.8
|
|
620
|
-
[0.0.9]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.8...v0.0.9
|
|
621
|
-
[0.0.9t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.9
|
|
622
|
-
[0.0.10]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.9...v0.0.10
|
|
623
|
-
[0.0.10t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.10
|
|
624
|
-
[0.0.11]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.10...v0.0.11
|
|
625
|
-
[0.0.11t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.11
|
|
626
|
-
[0.0.12]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.11...v0.0.12
|
|
627
|
-
[0.0.12t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.12
|
|
628
|
-
[0.0.13]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.12...v0.0.13
|
|
629
|
-
[0.0.13t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.13
|
|
630
|
-
[0.1.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.13...v0.1.0
|
|
631
|
-
[0.1.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.1.0
|
|
632
|
-
[0.1.1]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.1.0...v0.1.1
|
|
633
|
-
[0.1.1t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.1.1
|
|
634
|
-
[0.2.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.1.1...v0.2.0
|
|
635
|
-
[0.2.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.2.0
|
|
636
|
-
[0.3.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.2.0...v0.3.0
|
|
637
|
-
[0.3.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.3.0
|
|
638
|
-
[0.4.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.3.0...v0.4.0
|
|
639
|
-
[0.4.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.4.0
|
|
640
|
-
[0.4.1]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.4.0...v0.4.1
|
|
641
|
-
[0.4.1t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.4.1
|
|
642
|
-
[0.5.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.4.1...v0.5.0
|
|
643
|
-
[0.5.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.5.0
|
|
644
|
-
[1.0.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.9.4...v1.0.0
|
|
645
|
-
[1.0.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.0.0
|
|
646
|
-
[1.1.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.0.0...v1.1.0
|
|
647
|
-
[1.1.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.1.0
|
|
648
|
-
[1.2.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.1.0...v1.2.0
|
|
649
|
-
[1.2.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.2.0
|
|
650
|
-
[1.3.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.2.0...v1.3.0
|
|
651
|
-
[1.3.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.3.0
|
|
652
|
-
[1.3.1]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.3.0...v1.3.1
|
|
653
|
-
[1.3.1t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.3.1
|
|
654
|
-
[1.4.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.3.1...v1.4.0
|
|
655
|
-
[1.4.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.0
|
|
656
|
-
[1.4.1]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.0...v1.4.1
|
|
657
|
-
[1.4.1t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.1
|
|
658
|
-
[1.4.2]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.1...v1.4.2
|
|
659
|
-
[1.4.2t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.2
|
|
660
|
-
[1.4.3]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.2...v1.4.3
|
|
661
|
-
[1.4.3t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.3
|
|
662
|
-
[1.4.4]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.3...v1.4.4
|
|
663
|
-
[1.4.4t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.4
|
|
664
|
-
[1.4.5]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.4...v1.4.5
|
|
665
|
-
[1.4.5t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.5
|
|
666
|
-
[1.4.6]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.5...v1.4.6
|
|
667
|
-
[1.4.6t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.6
|
|
668
|
-
[1.4.7]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.6...v1.4.7
|
|
669
|
-
[1.4.7t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.7
|
|
670
|
-
[1.4.8]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.7...v1.4.8
|
|
671
|
-
[1.4.8t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.8
|
|
672
|
-
[1.4.9]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.8...v1.4.9
|
|
673
|
-
[1.4.9t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.9
|
|
674
|
-
[1.4.10]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.9...v1.4.10
|
|
675
|
-
[1.4.10t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.10
|
|
676
|
-
[1.4.11]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.10...v1.4.11
|
|
677
|
-
[1.4.11t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.11
|
|
678
|
-
[2.0.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.11...v2.0.0
|
|
679
|
-
[2.0.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.0
|
|
680
|
-
[2.0.1]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.0...v2.0.1
|
|
681
|
-
[2.0.1t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.1
|
|
682
|
-
[2.0.2]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.1...v2.0.2
|
|
683
|
-
[2.0.2t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.2
|
|
684
|
-
[2.0.3]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.2...v2.0.3
|
|
685
|
-
[2.0.3t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.3
|
|
686
|
-
[2.0.4]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.3...v2.0.4
|
|
687
|
-
[2.0.4t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.4
|
|
688
|
-
[2.0.5]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.4...v2.0.5
|
|
689
|
-
[2.0.5t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.5
|
|
690
|
-
[2.0.6]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.5...v2.0.6
|
|
691
|
-
[2.0.6t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.6
|
|
692
|
-
[2.0.7]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.6...v2.0.7
|
|
693
|
-
[2.0.7t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.7
|
|
694
|
-
[2.0.8]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.7...v2.0.8
|
|
695
|
-
[2.0.8t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.8
|
|
696
|
-
[2.0.9]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.8...v2.0.9
|
|
697
|
-
[2.0.9t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.9
|
|
698
|
-
[2.0.10]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.9...v2.0.10
|
|
699
|
-
[2.0.10t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.10
|
|
700
|
-
[2.0.11]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.10...v2.0.11
|
|
701
|
-
[2.0.11t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.11
|
|
702
|
-
[2.0.12]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.11...v2.0.12
|
|
703
|
-
[2.0.12t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.12
|
|
643
|
+
[Unreleased]: https://github.com/ruby-oauth/oauth2/compare/v2.0.14...HEAD
|
|
644
|
+
[2.0.14]: https://github.com/ruby-oauth/oauth2/compare/v2.0.13...v2.0.14
|
|
645
|
+
[2.0.14t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.14
|
|
704
646
|
[2.0.13]: https://github.com/ruby-oauth/oauth2/compare/v2.0.12...v2.0.13
|
|
705
647
|
[2.0.13t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.13
|
|
648
|
+
[2.0.12]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.11...v2.0.12
|
|
649
|
+
[2.0.12t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.12
|
|
650
|
+
[2.0.11]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.10...v2.0.11
|
|
651
|
+
[2.0.11t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.11
|
|
652
|
+
[2.0.10]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.9...v2.0.10
|
|
653
|
+
[2.0.10t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.10
|
|
654
|
+
[2.0.9]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.8...v2.0.9
|
|
655
|
+
[2.0.9t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.9
|
|
656
|
+
[2.0.8]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.7...v2.0.8
|
|
657
|
+
[2.0.8t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.8
|
|
658
|
+
[2.0.7]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.6...v2.0.7
|
|
659
|
+
[2.0.7t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.7
|
|
660
|
+
[2.0.6]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.5...v2.0.6
|
|
661
|
+
[2.0.6t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.6
|
|
662
|
+
[2.0.5]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.4...v2.0.5
|
|
663
|
+
[2.0.5t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.5
|
|
664
|
+
[2.0.4]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.3...v2.0.4
|
|
665
|
+
[2.0.4t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.4
|
|
666
|
+
[2.0.3]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.2...v2.0.3
|
|
667
|
+
[2.0.3t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.3
|
|
668
|
+
[2.0.2]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.1...v2.0.2
|
|
669
|
+
[2.0.2t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.2
|
|
670
|
+
[2.0.1]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v2.0.0...v2.0.1
|
|
671
|
+
[2.0.1t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.1
|
|
672
|
+
[2.0.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.11...v2.0.0
|
|
673
|
+
[2.0.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.0
|
|
674
|
+
[1.4.11]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.10...v1.4.11
|
|
675
|
+
[1.4.11t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.11
|
|
676
|
+
[1.4.10]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.9...v1.4.10
|
|
677
|
+
[1.4.10t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.10
|
|
678
|
+
[1.4.9]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.8...v1.4.9
|
|
679
|
+
[1.4.9t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.9
|
|
680
|
+
[1.4.8]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.7...v1.4.8
|
|
681
|
+
[1.4.8t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.8
|
|
682
|
+
[1.4.7]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.6...v1.4.7
|
|
683
|
+
[1.4.7t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.7
|
|
684
|
+
[1.4.6]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.5...v1.4.6
|
|
685
|
+
[1.4.6t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.6
|
|
686
|
+
[1.4.5]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.4...v1.4.5
|
|
687
|
+
[1.4.5t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.5
|
|
688
|
+
[1.4.4]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.3...v1.4.4
|
|
689
|
+
[1.4.4t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.4
|
|
690
|
+
[1.4.3]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.2...v1.4.3
|
|
691
|
+
[1.4.3t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.3
|
|
692
|
+
[1.4.2]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.1...v1.4.2
|
|
693
|
+
[1.4.2t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.2
|
|
694
|
+
[1.4.1]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.4.0...v1.4.1
|
|
695
|
+
[1.4.1t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.1
|
|
696
|
+
[1.4.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.3.1...v1.4.0
|
|
697
|
+
[1.4.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.4.0
|
|
698
|
+
[1.3.1]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.3.0...v1.3.1
|
|
699
|
+
[1.3.1t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.3.1
|
|
700
|
+
[1.3.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.2.0...v1.3.0
|
|
701
|
+
[1.3.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.3.0
|
|
702
|
+
[1.2.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.1.0...v1.2.0
|
|
703
|
+
[1.2.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.2.0
|
|
704
|
+
[1.1.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v1.0.0...v1.1.0
|
|
705
|
+
[1.1.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.1.0
|
|
706
|
+
[1.0.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.9.4...v1.0.0
|
|
707
|
+
[1.0.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v1.0.0
|
|
708
|
+
[0.5.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.4.1...v0.5.0
|
|
709
|
+
[0.5.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.5.0
|
|
710
|
+
[0.4.1]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.4.0...v0.4.1
|
|
711
|
+
[0.4.1t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.4.1
|
|
712
|
+
[0.4.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.3.0...v0.4.0
|
|
713
|
+
[0.4.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.4.0
|
|
714
|
+
[0.3.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.2.0...v0.3.0
|
|
715
|
+
[0.3.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.3.0
|
|
716
|
+
[0.2.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.1.1...v0.2.0
|
|
717
|
+
[0.2.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.2.0
|
|
718
|
+
[0.1.1]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.1.0...v0.1.1
|
|
719
|
+
[0.1.1t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.1.1
|
|
720
|
+
[0.1.0]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.13...v0.1.0
|
|
721
|
+
[0.1.0t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.1.0
|
|
722
|
+
[0.0.13]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.12...v0.0.13
|
|
723
|
+
[0.0.13t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.13
|
|
724
|
+
[0.0.12]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.11...v0.0.12
|
|
725
|
+
[0.0.12t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.12
|
|
726
|
+
[0.0.11]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.10...v0.0.11
|
|
727
|
+
[0.0.11t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.11
|
|
728
|
+
[0.0.10]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.9...v0.0.10
|
|
729
|
+
[0.0.10t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.10
|
|
730
|
+
[0.0.9]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.8...v0.0.9
|
|
731
|
+
[0.0.9t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.9
|
|
732
|
+
[0.0.8]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.7...v0.0.8
|
|
733
|
+
[0.0.8t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.8
|
|
734
|
+
[0.0.7]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.6...v0.0.7
|
|
735
|
+
[0.0.7t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.7
|
|
736
|
+
[0.0.6]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.5...v0.0.6
|
|
737
|
+
[0.0.6t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.6
|
|
738
|
+
[0.0.5]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.4...v0.0.5
|
|
739
|
+
[0.0.5t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.5
|
|
740
|
+
[0.0.4]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.3...v0.0.4
|
|
741
|
+
[0.0.4t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.4
|
|
742
|
+
[0.0.3]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.2...v0.0.3
|
|
743
|
+
[0.0.3t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.3
|
|
744
|
+
[0.0.2]: https://gitlab.com/ruby-oauth/oauth2/-/compare/v0.0.1...v0.0.2
|
|
745
|
+
[0.0.2t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.2
|
|
746
|
+
[0.0.1]: https://github.com/ruby-oauth/oauth2/compare/311d9f4...v0.0.1
|
|
747
|
+
[0.0.1t]: https://github.com/ruby-oauth/oauth2/releases/tag/v0.0.1
|
data/OIDC.md
ADDED
|
@@ -0,0 +1,158 @@
|
|
|
1
|
+
# OpenID Connect (OIDC) with ruby-oauth/oauth2
|
|
2
|
+
|
|
3
|
+
## OIDC Libraries
|
|
4
|
+
|
|
5
|
+
Libraries built on top of the oauth2 gem that implement OIDC.
|
|
6
|
+
|
|
7
|
+
- [gamora](https://github.com/amco/gamora-rb) - OpenID Connect Relying Party for Rails apps
|
|
8
|
+
- [omniauth-doximity-oauth2](https://github.com/doximity/omniauth-doximity-oauth2) - OmniAuth strategy for Doximity, supporting OIDC, and using PKCE
|
|
9
|
+
- [omniauth-himari](https://github.com/sorah/himari) - OmniAuth strategy to act as OIDC RP and use [Himari](https://github.com/sorah/himari) for OP
|
|
10
|
+
- [omniauth-mit-oauth2](https://github.com/MITLibraries/omniauth-mit-oauth2) - OmniAuth strategy for MIT OIDC
|
|
11
|
+
|
|
12
|
+
If any other libraries would like to be added to this list, please open an issue or pull request.
|
|
13
|
+
|
|
14
|
+
## Raw OIDC with ruby-oauth/oauth2
|
|
15
|
+
|
|
16
|
+
This document complements the inline documentation by focusing on OpenID Connect (OIDC) 1.0 usage patterns when using this gem as an OAuth 2.0 client library.
|
|
17
|
+
|
|
18
|
+
Scope of this document
|
|
19
|
+
- Audience: Developers building an OAuth 2.0/OIDC Relying Party (RP, aka client) in Ruby.
|
|
20
|
+
- Non-goals: This gem does not implement an OIDC Provider (OP, aka Authorization Server); for OP/server see other projects (e.g., doorkeeper + oidc extensions).
|
|
21
|
+
- Status: Informational documentation with links to normative specs. The gem intentionally remains protocol-agnostic beyond OAuth 2.0; OIDC specifics (like ID Token validation) must be handled by your application.
|
|
22
|
+
|
|
23
|
+
Key concepts refresher
|
|
24
|
+
- OAuth 2.0 delegates authorization; it does not define authentication of the end-user.
|
|
25
|
+
- OIDC layers an identity layer on top of OAuth 2.0, introducing:
|
|
26
|
+
- ID Token: a JWT carrying claims about the authenticated end-user and the authentication event.
|
|
27
|
+
- Standardized scopes: openid (mandatory), profile, email, address, phone, offline_access, and others.
|
|
28
|
+
- UserInfo endpoint: a protected resource for retrieving user profile claims.
|
|
29
|
+
- Discovery and Dynamic Client Registration (optional for providers/clients that support them).
|
|
30
|
+
|
|
31
|
+
What this gem provides for OIDC
|
|
32
|
+
- All OAuth 2.0 client capabilities required for OIDC flows: building authorization requests, exchanging authorization codes, refreshing tokens, and making authenticated resource requests.
|
|
33
|
+
- Transport and parsing conveniences (snaky hash, Faraday integration, error handling, etc.).
|
|
34
|
+
- Optional client authentication schemes useful with OIDC deployments:
|
|
35
|
+
- basic_auth (default)
|
|
36
|
+
- request_body (legacy)
|
|
37
|
+
- tls_client_auth (MTLS)
|
|
38
|
+
- private_key_jwt (OIDC-compliant when configured per OP requirements)
|
|
39
|
+
|
|
40
|
+
What you must add in your app for OIDC
|
|
41
|
+
- ID Token validation: This gem surfaces id_token values but does not verify them. Your app should:
|
|
42
|
+
1) Parse the JWT (header, payload, signature)
|
|
43
|
+
2) Fetch the OP JSON Web Key Set (JWKS) from discovery (or configure statically)
|
|
44
|
+
3) Select the correct key by kid (when present) and verify the signature and algorithm
|
|
45
|
+
4) Validate standard claims (iss, aud, exp, iat, nbf, azp, nonce when used, at_hash/c_hash when applicable)
|
|
46
|
+
5) Enforce expected client_id, issuer, and clock skew policies
|
|
47
|
+
- Nonce handling for Authorization Code flow with OIDC: generate a cryptographically-random nonce, bind it to the user session before redirect, include it in authorize request, and verify it in the ID Token on return.
|
|
48
|
+
- PKCE is best practice and often required by OPs: generate/verifier, send challenge in authorize, send verifier in token request.
|
|
49
|
+
- Session/state management: continue to validate state to mitigate CSRF; use exact redirect_uri matching.
|
|
50
|
+
|
|
51
|
+
Minimal OIDC Authorization Code example
|
|
52
|
+
|
|
53
|
+
```ruby
|
|
54
|
+
require "oauth2"
|
|
55
|
+
require "jwt" # jwt/ruby-jwt
|
|
56
|
+
require "net/http"
|
|
57
|
+
require "json"
|
|
58
|
+
|
|
59
|
+
client = OAuth2::Client.new(
|
|
60
|
+
ENV.fetch("OIDC_CLIENT_ID"),
|
|
61
|
+
ENV.fetch("OIDC_CLIENT_SECRET"),
|
|
62
|
+
site: ENV.fetch("OIDC_ISSUER"), # e.g. https://accounts.example.com
|
|
63
|
+
authorize_url: "/authorize", # or discovered
|
|
64
|
+
token_url: "/token", # or discovered
|
|
65
|
+
)
|
|
66
|
+
|
|
67
|
+
# Step 1: Redirect to OP for consent/auth
|
|
68
|
+
state = SecureRandom.hex(16)
|
|
69
|
+
nonce = SecureRandom.hex(16)
|
|
70
|
+
pkce_verifier = SecureRandom.urlsafe_base64(64)
|
|
71
|
+
pkce_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(pkce_verifier)).delete("=")
|
|
72
|
+
|
|
73
|
+
authz_url = client.auth_code.authorize_url(
|
|
74
|
+
scope: "openid profile email",
|
|
75
|
+
state: state,
|
|
76
|
+
nonce: nonce,
|
|
77
|
+
code_challenge: pkce_challenge,
|
|
78
|
+
code_challenge_method: "S256",
|
|
79
|
+
redirect_uri: ENV.fetch("OIDC_REDIRECT_URI"),
|
|
80
|
+
)
|
|
81
|
+
# redirect_to authz_url
|
|
82
|
+
|
|
83
|
+
# Step 2: Handle callback
|
|
84
|
+
# params[:code], params[:state]
|
|
85
|
+
raise "state mismatch" unless params[:state] == state
|
|
86
|
+
|
|
87
|
+
token = client.auth_code.get_token(
|
|
88
|
+
params[:code],
|
|
89
|
+
redirect_uri: ENV.fetch("OIDC_REDIRECT_URI"),
|
|
90
|
+
code_verifier: pkce_verifier,
|
|
91
|
+
)
|
|
92
|
+
|
|
93
|
+
# The token may include: access_token, id_token, refresh_token, etc.
|
|
94
|
+
id_token = token.params["id_token"] || token.params[:id_token]
|
|
95
|
+
|
|
96
|
+
# Step 3: Validate the ID Token (simplified – add your own checks!)
|
|
97
|
+
# Discover keys (example using .well-known)
|
|
98
|
+
issuer = ENV.fetch("OIDC_ISSUER")
|
|
99
|
+
jwks_uri = JSON.parse(Net::HTTP.get(URI.join(issuer, "/.well-known/openid-configuration"))).
|
|
100
|
+
fetch("jwks_uri")
|
|
101
|
+
jwks = JSON.parse(Net::HTTP.get(URI(jwks_uri)))
|
|
102
|
+
keys = jwks.fetch("keys")
|
|
103
|
+
|
|
104
|
+
# Use ruby-jwt JWK loader
|
|
105
|
+
jwk_set = JWT::JWK::Set.new(keys.map { |k| JWT::JWK.import(k) })
|
|
106
|
+
|
|
107
|
+
decoded, headers = JWT.decode(
|
|
108
|
+
id_token,
|
|
109
|
+
nil,
|
|
110
|
+
true,
|
|
111
|
+
algorithms: ["RS256", "ES256", "PS256"],
|
|
112
|
+
jwks: jwk_set,
|
|
113
|
+
verify_iss: true,
|
|
114
|
+
iss: issuer,
|
|
115
|
+
verify_aud: true,
|
|
116
|
+
aud: ENV.fetch("OIDC_CLIENT_ID"),
|
|
117
|
+
)
|
|
118
|
+
|
|
119
|
+
# Verify nonce
|
|
120
|
+
raise "nonce mismatch" unless decoded["nonce"] == nonce
|
|
121
|
+
|
|
122
|
+
# Optionally: call UserInfo
|
|
123
|
+
userinfo = token.get("/userinfo").parsed
|
|
124
|
+
```
|
|
125
|
+
|
|
126
|
+
Notes on discovery and registration
|
|
127
|
+
- Discovery: Most OPs publish configuration at {issuer}/.well-known/openid-configuration (OIDC Discovery 1.0). From there, resolve authorization_endpoint, token_endpoint, jwks_uri, userinfo_endpoint, etc.
|
|
128
|
+
- Dynamic Client Registration: Some OPs allow registering clients programmatically (OIDC Dynamic Client Registration 1.0). This gem does not implement registration; use a plain HTTP client or Faraday and store credentials securely.
|
|
129
|
+
|
|
130
|
+
Common pitfalls and tips
|
|
131
|
+
- Always request the openid scope when you expect an ID Token. Without it, the OP may behave as vanilla OAuth 2.0.
|
|
132
|
+
- Validate ID Token signature and claims before trusting any identity data. Do not rely solely on the presence of an id_token field.
|
|
133
|
+
- Prefer Authorization Code + PKCE. Avoid Implicit; it is discouraged in modern guidance and may be disabled by providers.
|
|
134
|
+
- Use exact redirect_uri matching, and keep your allow-list short.
|
|
135
|
+
- For public clients that use refresh tokens, prefer sender-constrained tokens (DPoP/MTLS) or rotation with one-time-use refresh tokens, per modern best practices.
|
|
136
|
+
- When using private_key_jwt, ensure the "aud" (or token_url) and "iss/sub" claims are set per the OP’s rules, and include kid in the JWT header when required so the OP can select the right key.
|
|
137
|
+
|
|
138
|
+
Relevant specifications and references
|
|
139
|
+
- OpenID Connect Core 1.0: https://openid.net/specs/openid-connect-core-1_0.html
|
|
140
|
+
- OIDC Core (final): https://openid.net/specs/openid-connect-core-1_0-final.html
|
|
141
|
+
- How OIDC works: https://openid.net/developers/how-connect-works/
|
|
142
|
+
- OpenID Connect home: https://openid.net/connect/
|
|
143
|
+
- OIDC Discovery 1.0: https://openid.net/specs/openid-connect-discovery-1_0.html
|
|
144
|
+
- OIDC Dynamic Client Registration 1.0: https://openid.net/specs/openid-connect-registration-1_0.html
|
|
145
|
+
- OIDC Session Management 1.0: https://openid.net/specs/openid-connect-session-1_0.html
|
|
146
|
+
- OIDC RP-Initiated Logout 1.0: https://openid.net/specs/openid-connect-rpinitiated-1_0.html
|
|
147
|
+
- OIDC Back-Channel Logout 1.0: https://openid.net/specs/openid-connect-backchannel-1_0.html
|
|
148
|
+
- OIDC Front-Channel Logout 1.0: https://openid.net/specs/openid-connect-frontchannel-1_0.html
|
|
149
|
+
- Auth0 OIDC overview: https://auth0.com/docs/authenticate/protocols/openid-connect-protocol
|
|
150
|
+
- Spring Authorization Server’s list of OAuth2/OIDC specs: https://github.com/spring-projects/spring-authorization-server/wiki/OAuth2-and-OIDC-Specifications
|
|
151
|
+
|
|
152
|
+
See also
|
|
153
|
+
- README sections on OAuth 2.1 notes and OIDC notes
|
|
154
|
+
- Strategy classes under lib/oauth2/strategy for flow helpers
|
|
155
|
+
- Specs under spec/oauth2 for concrete usage patterns
|
|
156
|
+
|
|
157
|
+
Contributions welcome
|
|
158
|
+
- If you discover provider-specific nuances, consider contributing examples or clarifications (without embedding provider-specific hacks into the library).
|
data/README.md
CHANGED
|
@@ -61,30 +61,37 @@ NOTE: `header` - The content type specified in the `curl` is already the default
|
|
|
61
61
|
|
|
62
62
|
</details>
|
|
63
63
|
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
This project sits underneath a large portion of the authorization systems on the internet.
|
|
67
|
-
According to GitHub's project tracking, which I believe only reports on public projects,
|
|
68
|
-
[100,000+ projects](https://github.com/ruby-oauth/oauth2/network/dependents), and
|
|
69
|
-
[500+ packages](https://github.com/ruby-oauth/oauth2/network/dependents?dependent_type=PACKAGE) depend on this project.
|
|
64
|
+
If it seems like you are in the wrong place, you might try one of these:
|
|
70
65
|
|
|
71
|
-
|
|
66
|
+
* [OAuth 2.0 Spec][oauth2-spec]
|
|
67
|
+
* [doorkeeper gem][doorkeeper-gem] for OAuth 2.0 server/provider implementation.
|
|
68
|
+
* [oauth sibling gem][sibling-gem] for OAuth 1.0a implementations in Ruby.
|
|
72
69
|
|
|
73
|
-
|
|
74
|
-
|
|
70
|
+
[oauth2-spec]: https://oauth.net/2/
|
|
71
|
+
[sibling-gem]: https://gitlab.com/ruby-oauth/oauth
|
|
72
|
+
[doorkeeper-gem]: https://github.com/doorkeeper-gem/doorkeeper
|
|
75
73
|
|
|
76
|
-
|
|
74
|
+
## 💡 Info you can shake a stick at
|
|
77
75
|
|
|
78
|
-
|
|
79
|
-
|
|
76
|
+
| Tokens to Remember | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace] |
|
|
77
|
+
|-------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
78
|
+
| Works with JRuby | ![JRuby 9.1 Compat][💎jruby-9.1i] ![JRuby 9.2 Compat][💎jruby-9.2i] ![JRuby 9.3 Compat][💎jruby-9.3i] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎10-j-wf] [![JRuby 10.0 Compat][💎jruby-c-i]][🚎11-c-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf] |
|
|
79
|
+
| Works with Truffle Ruby | ![Truffle Ruby 22.3 Compat][💎truby-22.3i] ![Truffle Ruby 23.0 Compat][💎truby-23.0i] <br/> [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎9-t-wf] [![Truffle Ruby 24.1 Compat][💎truby-c-i]][🚎11-c-wf] |
|
|
80
|
+
| Works with MRI Ruby 3 | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎4-lg-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎6-s-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎6-s-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎6-s-wf] [![Ruby 3.4 Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf] |
|
|
81
|
+
| Works with MRI Ruby 2 | ![Ruby 2.2 Compat][💎ruby-2.2i] <br/> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎1-an-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎1-an-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎1-an-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎7-us-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎7-us-wf] |
|
|
82
|
+
| Source | [![Source on GitLab.com][📜src-gl-img]][📜src-gl] [![Source on CodeBerg.org][📜src-cb-img]][📜src-cb] [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc] |
|
|
83
|
+
| Documentation | [![Discussion][⛳gg-discussions-img]][⛳gg-discussions] [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![Wiki][📜wiki-img]][📜wiki] |
|
|
84
|
+
| Compliance | [![License: MIT][📄license-img]][📄license-ref] [![📄ilo-declaration-img]][📄ilo-declaration] [![Security Policy][🔐security-img]][🔐security] [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct] [![SemVer 2.0.0][📌semver-img]][📌semver] |
|
|
85
|
+
| Style | [![Enforced Code Style Linter][💎rlts-img]][💎rlts] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog] [![Gitmoji Commits][📌gitmoji-img]][📌gitmoji] [![Compatibility appraised by: appraisal2][💎appraisal2-img]][💎appraisal2] |
|
|
86
|
+
| Support | [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼🏫expsup-upwork-img]][👨🏼🏫expsup-upwork] [![Get help from me on Codementor][👨🏼🏫expsup-codementor-img]][👨🏼🏫expsup-codementor] |
|
|
87
|
+
| Maintainer 🎖️ | [![Follow Me on LinkedIn][💖🖇linkedin-img]][💖🖇linkedin] [![Follow Me on Ruby.Social][💖🐘ruby-mast-img]][💖🐘ruby-mast] [![Follow Me on Bluesky][💖🦋bluesky-img]][💖🦋bluesky] [![Contact Maintainer][🚂maint-contact-img]][🚂maint-contact] [![My technical writing][💖💁🏼♂️devto-img]][💖💁🏼♂️devto] |
|
|
88
|
+
| `...` 💖 | [![Find Me on WellFound:][💖✌️wellfound-img]][💖✌️wellfound] [![Find Me on CrunchBase][💖💲crunchbase-img]][💖💲crunchbase] [![My LinkTree][💖🌳linktree-img]][💖🌳linktree] [![More About Me][💖💁🏼♂️aboutme-img]][💖💁🏼♂️aboutme] [🧊][💖🧊berg] [🐙][💖🐙hub] [🛖][💖🛖hut] [🧪][💖🧪lab] |
|
|
80
89
|
|
|
81
|
-
|
|
82
|
-
|------------------------------------------------|--------------------------------------------------------------------------------------|
|
|
83
|
-
| 👟 Check it out! | ✨ [github.com/appraisal-rb/appraisal2](https://github.com/appraisal-rb/appraisal2) ✨ |
|
|
90
|
+
### Compatibility
|
|
84
91
|
|
|
85
92
|
* Operating Systems: Linux, MacOS, Windows
|
|
86
93
|
* MRI Ruby @ v2.3, v2.4, v2.5, v2.6, v2.7, v3.0, v3.1, v3.2, v3.3, v3.4, HEAD
|
|
87
|
-
|
|
94
|
+
* NOTE: This gem will still install on ruby v2.2, but vanilla GitHub Actions no longer supports testing against it, so YMMV.
|
|
88
95
|
* JRuby @ v9.2, v9.3, v9.4, v10.0, HEAD
|
|
89
96
|
* TruffleRuby @ v23.1, v24.1, HEAD
|
|
90
97
|
* gem `faraday` @ v0, v1, v2, HEAD ⏩️ [lostisland/faraday](https://github.com/lostisland/faraday)
|
|
@@ -102,11 +109,32 @@ Also, where reasonable, tested against the runtime dependencies of those depende
|
|
|
102
109
|
|
|
103
110
|
* gem `hashie` @ v0, v1, v2, v3, v4, v5, HEAD ⏩️ [hashie/hashie](https://github.com/hashie/hashie)
|
|
104
111
|
|
|
112
|
+
#### Upgrading Runtime Gem Dependencies
|
|
113
|
+
|
|
114
|
+
This project sits underneath a large portion of the authorization systems on the internet.
|
|
115
|
+
According to GitHub's project tracking, which I believe only reports on public projects,
|
|
116
|
+
[100,000+ projects](https://github.com/ruby-oauth/oauth2/network/dependents), and
|
|
117
|
+
[500+ packages](https://github.com/ruby-oauth/oauth2/network/dependents?dependent_type=PACKAGE) depend on this project.
|
|
118
|
+
|
|
119
|
+
That means it is painful for the Ruby community when this gem forces updates to its runtime dependencies.
|
|
120
|
+
|
|
121
|
+
As a result, great care, and a lot of time, have been invested to ensure this gem is working with all the
|
|
122
|
+
leading versions per each minor version of Ruby of all the runtime dependencies it can install with.
|
|
123
|
+
|
|
124
|
+
What does that mean specifically for the runtime dependencies?
|
|
125
|
+
|
|
126
|
+
We have 100% test coverage of lines and branches, and this test suite runs across a large matrix
|
|
127
|
+
covering the latest patch for each of the following minor versions:
|
|
128
|
+
|
|
129
|
+
| 🚚 _Amazing_ test matrix was brought to you by | 🔎 appraisal2 🔎 |
|
|
130
|
+
|------------------------------------------------|--------------------------------------------------------------------------------------|
|
|
131
|
+
| 👟 Check it out! | ✨ [github.com/appraisal-rb/appraisal2](https://github.com/appraisal-rb/appraisal2) ✨ |
|
|
132
|
+
|
|
105
133
|
#### You should upgrade this gem with confidence\*.
|
|
106
134
|
|
|
107
135
|
- This gem follows a _strict & correct_ (according to the maintainer of SemVer; [more info][sv-pub-api]) interpretation of SemVer.
|
|
108
|
-
|
|
109
|
-
|
|
136
|
+
- Dropping support for **any** of the runtime dependency versions above will be a major version bump.
|
|
137
|
+
- If you aren't on one of the minor versions above, make getting there a priority.
|
|
110
138
|
- You should upgrade the dependencies of this gem with confidence\*.
|
|
111
139
|
- Please do upgrade, and then, when it goes smooth as butter [please sponsor me][🖇sponsor]. Thanks!
|
|
112
140
|
|
|
@@ -129,52 +157,18 @@ If you use a gem version of a core Ruby library it should work fine!
|
|
|
129
157
|
|
|
130
158
|
</details>
|
|
131
159
|
|
|
132
|
-
If it seems like you are in the wrong place, you might try one of these:
|
|
133
|
-
|
|
134
|
-
* [OAuth 2.0 Spec][oauth2-spec]
|
|
135
|
-
* [doorkeeper gem][doorkeeper-gem] for OAuth 2.0 server/provider implementation.
|
|
136
|
-
* [oauth sibling gem][sibling-gem] for OAuth 1.0 implementations in Ruby.
|
|
137
|
-
|
|
138
|
-
[oauth2-spec]: https://oauth.net/2/
|
|
139
|
-
[sibling-gem]: https://gitlab.com/ruby-oauth/oauth
|
|
140
|
-
[doorkeeper-gem]: https://github.com/doorkeeper-gem/doorkeeper
|
|
141
|
-
|
|
142
|
-
## 💡 Info you can shake a stick at
|
|
143
|
-
|
|
144
|
-
| Tokens to Remember | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace] |
|
|
145
|
-
|-------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
146
|
-
| Works with JRuby | ![JRuby 9.1 Compat][💎jruby-9.1i] ![JRuby 9.2 Compat][💎jruby-9.2i] ![JRuby 9.3 Compat][💎jruby-9.3i] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎10-j-wf] [![JRuby 10.0 Compat][💎jruby-c-i]][🚎11-c-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf] |
|
|
147
|
-
| Works with Truffle Ruby | ![Truffle Ruby 22.3 Compat][💎truby-22.3i] ![Truffle Ruby 23.0 Compat][💎truby-23.0i] <br/> [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎9-t-wf] [![Truffle Ruby 24.1 Compat][💎truby-c-i]][🚎11-c-wf] |
|
|
148
|
-
| Works with MRI Ruby 3 | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎4-lg-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎6-s-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎6-s-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎6-s-wf] [![Ruby 3.4 Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf] |
|
|
149
|
-
| Works with MRI Ruby 2 | ![Ruby 2.2 Compat][💎ruby-2.2i] <br/> [![Ruby 2.3 Compat][💎ruby-2.3i]][🚎1-an-wf] [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎1-an-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎1-an-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎7-us-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎7-us-wf] |
|
|
150
|
-
| Source | [![Source on GitLab.com][📜src-gl-img]][📜src-gl] [![Source on CodeBerg.org][📜src-cb-img]][📜src-cb] [![Source on Github.com][📜src-gh-img]][📜src-gh] [![The best SHA: dQw4w9WgXcQ!][🧮kloc-img]][🧮kloc] |
|
|
151
|
-
| Documentation | [![Current release on RubyDoc.info][📜docs-cr-rd-img]][🚎yard-current] [![YARD on Galtzo.com][📜docs-head-rd-img]][🚎yard-head] [![Maintainer Blog][🚂maint-blog-img]][🚂maint-blog] [![Wiki][📜wiki-img]][📜wiki] |
|
|
152
|
-
| Compliance | [![License: MIT][📄license-img]][📄license-ref] [![📄ilo-declaration-img]][📄ilo-declaration] [![Security Policy][🔐security-img]][🔐security] [![Contributor Covenant 2.1][🪇conduct-img]][🪇conduct] [![SemVer 2.0.0][📌semver-img]][📌semver] |
|
|
153
|
-
| Style | [![Enforced Code Style Linter][💎rlts-img]][💎rlts] [![Keep-A-Changelog 1.0.0][📗keep-changelog-img]][📗keep-changelog] [![Gitmoji Commits][📌gitmoji-img]][📌gitmoji] [![Compatibility appraised by: appraisal2][💎appraisal2-img]][💎appraisal2] |
|
|
154
|
-
| Support | [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] [![Get help from me on Upwork][👨🏼🏫expsup-upwork-img]][👨🏼🏫expsup-upwork] [![Get help from me on Codementor][👨🏼🏫expsup-codementor-img]][👨🏼🏫expsup-codementor] |
|
|
155
|
-
| Maintainer 🎖️ | [![Follow Me on LinkedIn][💖🖇linkedin-img]][💖🖇linkedin] [![Follow Me on Ruby.Social][💖🐘ruby-mast-img]][💖🐘ruby-mast] [![Follow Me on Bluesky][💖🦋bluesky-img]][💖🦋bluesky] [![Contact Maintainer][🚂maint-contact-img]][🚂maint-contact] [![My technical writing][💖💁🏼♂️devto-img]][💖💁🏼♂️devto] |
|
|
156
|
-
| `...` 💖 | [![Find Me on WellFound:][💖✌️wellfound-img]][💖✌️wellfound] [![Find Me on CrunchBase][💖💲crunchbase-img]][💖💲crunchbase] [![My LinkTree][💖🌳linktree-img]][💖🌳linktree] [![More About Me][💖💁🏼♂️aboutme-img]][💖💁🏼♂️aboutme] [🧊][💖🧊berg] [🐙][💖🐙hub] [🛖][💖🛖hut] [🧪][💖🧪lab] |
|
|
157
|
-
|
|
158
|
-
### Compatibility
|
|
159
|
-
|
|
160
|
-
Compatible with Ruby 2.3+, and concordant releases of JRuby, and TruffleRuby.
|
|
161
|
-
|
|
162
|
-
| 🚚 _Amazing_ test matrix was brought to you by | 🔎 appraisal2 🔎 |
|
|
163
|
-
|------------------------------------------------|-------------------------------------------------------------------------------------|
|
|
164
|
-
| 👟 Check it out! | ✨ [github.com/appraisal-rb/appraisal2][💎appraisal2] ✨ |
|
|
165
|
-
|
|
166
160
|
### Federated DVCS
|
|
167
161
|
|
|
168
162
|
<details>
|
|
169
163
|
<summary>Find this repo on other forges (Coming soon!)</summary>
|
|
170
164
|
|
|
171
|
-
| Federated [DVCS][💎d-in-dvcs] Repository
|
|
172
|
-
|
|
173
|
-
| 🧪 [ruby-oauth/oauth2 on GitLab][📜src-gl]
|
|
174
|
-
| 🧊 [ruby-oauth/oauth2 on CodeBerg][📜src-cb]
|
|
175
|
-
| 🐙 [ruby-oauth/oauth2 on GitHub][📜src-gh]
|
|
176
|
-
| 🤼 [OAuth Ruby Google Group][⛳gg-discussions] | "Active"
|
|
177
|
-
| 🎮️ [Discord Server][✉️discord-invite]
|
|
165
|
+
| Federated [DVCS][💎d-in-dvcs] Repository | Status | Issues | PRs | Wiki | CI | Discussions |
|
|
166
|
+
|-----------------------------------------------|-----------------------------------------------------------------------|---------------------------|--------------------------|---------------------------|--------------------------|------------------------------|
|
|
167
|
+
| 🧪 [ruby-oauth/oauth2 on GitLab][📜src-gl] | The Truth | [💚][🤝gl-issues] | [💚][🤝gl-pulls] | [💚][📜wiki] | 🏀 Tiny Matrix | ➖ |
|
|
168
|
+
| 🧊 [ruby-oauth/oauth2 on CodeBerg][📜src-cb] | An Ethical Mirror ([Donate][🤝cb-donate]) | [💚][🤝cb-issues] | [💚][🤝cb-pulls] | ➖ | ⭕️ No Matrix | ➖ |
|
|
169
|
+
| 🐙 [ruby-oauth/oauth2 on GitHub][📜src-gh] | Another Mirror | [💚][🤝gh-issues] | [💚][🤝gh-pulls] | ➖ | 💯 Full Matrix | [💚][gh-discussions] |
|
|
170
|
+
| 🤼 [OAuth Ruby Google Group][⛳gg-discussions] | "Active" | ➖ | ➖ | ➖ | ➖ | [💚][⛳gg-discussions] |
|
|
171
|
+
| 🎮️ [Discord Server][✉️discord-invite] | [![Live Chat on Discord][✉️discord-invite-img-ftb]][✉️discord-invite] | [Let's][✉️discord-invite] | [talk][✉️discord-invite] | [about][✉️discord-invite] | [this][✉️discord-invite] | [library!][✉️discord-invite] |
|
|
178
172
|
|
|
179
173
|
</details>
|
|
180
174
|
|
|
@@ -182,9 +176,13 @@ Compatible with Ruby 2.3+, and concordant releases of JRuby, and TruffleRuby.
|
|
|
182
176
|
|
|
183
177
|
### Enterprise Support [](https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&utm_medium=referral&utm_campaign=readme)
|
|
184
178
|
|
|
179
|
+
Available as part of the Tidelift Subscription.
|
|
180
|
+
|
|
185
181
|
<details>
|
|
186
182
|
<summary>Need enterprise-level guarantees?</summary>
|
|
187
183
|
|
|
184
|
+
The maintainers of this and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use.
|
|
185
|
+
|
|
188
186
|
[![Get help from me on Tidelift][🏙️entsup-tidelift-img]][🏙️entsup-tidelift]
|
|
189
187
|
|
|
190
188
|
- 💡Subscribe for support guarantees covering _all_ your FLOSS dependencies
|
|
@@ -199,6 +197,131 @@ Alternatively:
|
|
|
199
197
|
|
|
200
198
|
</details>
|
|
201
199
|
|
|
200
|
+
## 🚀 Release Documentation
|
|
201
|
+
|
|
202
|
+
### Version 2.0.x
|
|
203
|
+
|
|
204
|
+
<details>
|
|
205
|
+
<summary>2.0.x CHANGELOG and README</summary>
|
|
206
|
+
|
|
207
|
+
| Version | Release Date | CHANGELOG | README |
|
|
208
|
+
|---------|--------------|---------------------------------------|---------------------------------|
|
|
209
|
+
| 2.0.13 | 2025-08-30 | [v2.0.13 CHANGELOG][2.0.13-changelog] | [v2.0.13 README][2.0.13-readme] |
|
|
210
|
+
| 2.0.12 | 2025-05-31 | [v2.0.12 CHANGELOG][2.0.12-changelog] | [v2.0.12 README][2.0.12-readme] |
|
|
211
|
+
| 2.0.11 | 2025-05-23 | [v2.0.11 CHANGELOG][2.0.11-changelog] | [v2.0.11 README][2.0.11-readme] |
|
|
212
|
+
| 2.0.10 | 2025-05-17 | [v2.0.10 CHANGELOG][2.0.10-changelog] | [v2.0.10 README][2.0.10-readme] |
|
|
213
|
+
| 2.0.9 | 2022-09-16 | [v2.0.9 CHANGELOG][2.0.9-changelog] | [v2.0.9 README][2.0.9-readme] |
|
|
214
|
+
| 2.0.8 | 2022-09-01 | [v2.0.8 CHANGELOG][2.0.8-changelog] | [v2.0.8 README][2.0.8-readme] |
|
|
215
|
+
| 2.0.7 | 2022-08-22 | [v2.0.7 CHANGELOG][2.0.7-changelog] | [v2.0.7 README][2.0.7-readme] |
|
|
216
|
+
| 2.0.6 | 2022-07-13 | [v2.0.6 CHANGELOG][2.0.6-changelog] | [v2.0.6 README][2.0.6-readme] |
|
|
217
|
+
| 2.0.5 | 2022-07-07 | [v2.0.5 CHANGELOG][2.0.5-changelog] | [v2.0.5 README][2.0.5-readme] |
|
|
218
|
+
| 2.0.4 | 2022-07-01 | [v2.0.4 CHANGELOG][2.0.4-changelog] | [v2.0.4 README][2.0.4-readme] |
|
|
219
|
+
| 2.0.3 | 2022-06-28 | [v2.0.3 CHANGELOG][2.0.3-changelog] | [v2.0.3 README][2.0.3-readme] |
|
|
220
|
+
| 2.0.2 | 2022-06-24 | [v2.0.2 CHANGELOG][2.0.2-changelog] | [v2.0.2 README][2.0.2-readme] |
|
|
221
|
+
| 2.0.1 | 2022-06-22 | [v2.0.1 CHANGELOG][2.0.1-changelog] | [v2.0.1 README][2.0.1-readme] |
|
|
222
|
+
| 2.0.0 | 2022-06-21 | [v2.0.0 CHANGELOG][2.0.0-changelog] | [v2.0.0 README][2.0.0-readme] |
|
|
223
|
+
|
|
224
|
+
</details>
|
|
225
|
+
|
|
226
|
+
[2.0.13-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2013---2025-08-30
|
|
227
|
+
[2.0.12-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2012---2025-05-31
|
|
228
|
+
[2.0.11-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2011---2025-05-23
|
|
229
|
+
[2.0.10-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#2010---2025-05-17
|
|
230
|
+
[2.0.9-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#209---2022-09-16
|
|
231
|
+
[2.0.8-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#208---2022-09-01
|
|
232
|
+
[2.0.7-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#207---2022-08-22
|
|
233
|
+
[2.0.6-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#206---2022-07-13
|
|
234
|
+
[2.0.5-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#205---2022-07-07
|
|
235
|
+
[2.0.4-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#204---2022-07-01
|
|
236
|
+
[2.0.3-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#203---2022-06-28
|
|
237
|
+
[2.0.2-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#202---2022-06-24
|
|
238
|
+
[2.0.1-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#201---2022-06-22
|
|
239
|
+
[2.0.0-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#200---2022-06-21
|
|
240
|
+
|
|
241
|
+
[2.0.13-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.13/README.md
|
|
242
|
+
[2.0.12-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.12/README.md
|
|
243
|
+
[2.0.11-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.11/README.md
|
|
244
|
+
[2.0.10-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.10/README.md
|
|
245
|
+
[2.0.9-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.9/README.md
|
|
246
|
+
[2.0.8-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.8/README.md
|
|
247
|
+
[2.0.7-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.7/README.md
|
|
248
|
+
[2.0.6-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.6/README.md
|
|
249
|
+
[2.0.5-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.5/README.md
|
|
250
|
+
[2.0.4-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.4/README.md
|
|
251
|
+
[2.0.3-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.3/README.md
|
|
252
|
+
[2.0.2-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.2/README.md
|
|
253
|
+
[2.0.1-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.1/README.md
|
|
254
|
+
[2.0.0-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.0/README.md
|
|
255
|
+
|
|
256
|
+
### Older Releases
|
|
257
|
+
|
|
258
|
+
<details>
|
|
259
|
+
<summary>1.4.x CHANGELOGs and READMEs</summary>
|
|
260
|
+
|
|
261
|
+
| Version | Release Date | CHANGELOG | README |
|
|
262
|
+
|---------|--------------|---------------------------------------|---------------------------------|
|
|
263
|
+
| 1.4.11 | Sep 16, 2022 | [v1.4.11 CHANGELOG][1.4.11-changelog] | [v1.4.11 README][1.4.11-readme] |
|
|
264
|
+
| 1.4.10 | Jul 1, 2022 | [v1.4.10 CHANGELOG][1.4.10-changelog] | [v1.4.10 README][1.4.10-readme] |
|
|
265
|
+
| 1.4.9 | Feb 20, 2022 | [v1.4.9 CHANGELOG][1.4.9-changelog] | [v1.4.9 README][1.4.9-readme] |
|
|
266
|
+
| 1.4.8 | Feb 18, 2022 | [v1.4.8 CHANGELOG][1.4.8-changelog] | [v1.4.8 README][1.4.8-readme] |
|
|
267
|
+
| 1.4.7 | Mar 19, 2021 | [v1.4.7 CHANGELOG][1.4.7-changelog] | [v1.4.7 README][1.4.7-readme] |
|
|
268
|
+
| 1.4.6 | Mar 19, 2021 | [v1.4.6 CHANGELOG][1.4.6-changelog] | [v1.4.6 README][1.4.6-readme] |
|
|
269
|
+
| 1.4.5 | Mar 18, 2021 | [v1.4.5 CHANGELOG][1.4.5-changelog] | [v1.4.5 README][1.4.5-readme] |
|
|
270
|
+
| 1.4.4 | Feb 12, 2020 | [v1.4.4 CHANGELOG][1.4.4-changelog] | [v1.4.4 README][1.4.4-readme] |
|
|
271
|
+
| 1.4.3 | Jan 29, 2020 | [v1.4.3 CHANGELOG][1.4.3-changelog] | [v1.4.3 README][1.4.3-readme] |
|
|
272
|
+
| 1.4.2 | Oct 1, 2019 | [v1.4.2 CHANGELOG][1.4.2-changelog] | [v1.4.2 README][1.4.2-readme] |
|
|
273
|
+
| 1.4.1 | Oct 13, 2018 | [v1.4.1 CHANGELOG][1.4.1-changelog] | [v1.4.1 README][1.4.1-readme] |
|
|
274
|
+
| 1.4.0 | Jun 9, 2017 | [v1.4.0 CHANGELOG][1.4.0-changelog] | [v1.4.0 README][1.4.0-readme] |
|
|
275
|
+
</details>
|
|
276
|
+
|
|
277
|
+
[1.4.11-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#1411---2022-09-16
|
|
278
|
+
[1.4.10-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#1410---2022-07-01
|
|
279
|
+
[1.4.9-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#149---2022-02-20
|
|
280
|
+
[1.4.8-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#148---2022-02-18
|
|
281
|
+
[1.4.7-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#147---2021-03-19
|
|
282
|
+
[1.4.6-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#146---2021-03-19
|
|
283
|
+
[1.4.5-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#145---2021-03-18
|
|
284
|
+
[1.4.4-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#144---2020-02-12
|
|
285
|
+
[1.4.3-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#143---2020-01-29
|
|
286
|
+
[1.4.2-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#142---2019-10-01
|
|
287
|
+
[1.4.1-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#141---2018-10-13
|
|
288
|
+
[1.4.0-changelog]: https://gitlab.com/ruby-oauth/oauth2/-/blob/main/CHANGELOG.md?ref_type=heads#140---2017-06-09
|
|
289
|
+
|
|
290
|
+
[1.4.11-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.11/README.md
|
|
291
|
+
[1.4.10-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.10/README.md
|
|
292
|
+
[1.4.9-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.9/README.md
|
|
293
|
+
[1.4.8-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.8/README.md
|
|
294
|
+
[1.4.7-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.7/README.md
|
|
295
|
+
[1.4.6-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.6/README.md
|
|
296
|
+
[1.4.5-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.5/README.md
|
|
297
|
+
[1.4.4-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.4/README.md
|
|
298
|
+
[1.4.3-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.3/README.md
|
|
299
|
+
[1.4.2-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.2/README.md
|
|
300
|
+
[1.4.1-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.1/README.md
|
|
301
|
+
[1.4.0-readme]: https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.4.0/README.md
|
|
302
|
+
|
|
303
|
+
<details>
|
|
304
|
+
<summary>1.3.x Readmes</summary>
|
|
305
|
+
|
|
306
|
+
| Version | Release Date | Readme |
|
|
307
|
+
|---------|--------------|--------------------------------------------------------------|
|
|
308
|
+
| 1.3.1 | Mar 3, 2017 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.3.1/README.md |
|
|
309
|
+
| 1.3.0 | Dec 27, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.3.0/README.md |
|
|
310
|
+
|
|
311
|
+
</details>
|
|
312
|
+
|
|
313
|
+
<details>
|
|
314
|
+
<summary>≤= 1.2.x Readmes (2016 and before)</summary>
|
|
315
|
+
|
|
316
|
+
| Version | Release Date | Readme |
|
|
317
|
+
|---------|--------------|--------------------------------------------------------------|
|
|
318
|
+
| 1.2.0 | Jun 30, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.2.0/README.md |
|
|
319
|
+
| 1.1.0 | Jan 30, 2016 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.1.0/README.md |
|
|
320
|
+
| 1.0.0 | May 23, 2014 | https://gitlab.com/ruby-oauth/oauth2/-/blob/v1.0.0/README.md |
|
|
321
|
+
| < 1.0.0 | Find here | https://gitlab.com/ruby-oauth/oauth2/-/tags |
|
|
322
|
+
|
|
323
|
+
</details>
|
|
324
|
+
|
|
202
325
|
## ✨ Installation
|
|
203
326
|
|
|
204
327
|
Install the gem and add to the application's Gemfile by executing:
|
|
@@ -248,21 +371,6 @@ NOTE: Be prepared to track down certs for signed gems and add them the same way
|
|
|
248
371
|
|
|
249
372
|
</details>
|
|
250
373
|
|
|
251
|
-
## OAuth2 for Enterprise
|
|
252
|
-
|
|
253
|
-
Available as part of the Tidelift Subscription.
|
|
254
|
-
|
|
255
|
-
The maintainers of this and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use. [Learn more.][tidelift-ref]
|
|
256
|
-
|
|
257
|
-
[tidelift-ref]: https://tidelift.com/subscription/pkg/rubygems-oauth2?utm_source=rubygems-oauth2&utm_medium=referral&utm_campaign=enterprise
|
|
258
|
-
|
|
259
|
-
## Security contact information
|
|
260
|
-
|
|
261
|
-
To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security).
|
|
262
|
-
Tidelift will coordinate the fix and disclosure.
|
|
263
|
-
|
|
264
|
-
For more see [SECURITY.md][🔐security].
|
|
265
|
-
|
|
266
374
|
## What is new for v2.0?
|
|
267
375
|
|
|
268
376
|
- Works with Ruby versions >= 2.2
|
|
@@ -515,7 +623,7 @@ end
|
|
|
515
623
|
|
|
516
624
|
See [response_spec.rb](https://github.com/ruby-oauth/oauth2/blob/main/spec/oauth2/response_spec.rb), or the [ruby-oauth/snaky_hash](https://gitlab.com/ruby-oauth/snaky_hash) gem for more ideas.
|
|
517
625
|
|
|
518
|
-
####
|
|
626
|
+
#### Prefer camelCase over snake_case? => snaky: false
|
|
519
627
|
|
|
520
628
|
```ruby
|
|
521
629
|
response = access.get("/api/resource", params: {"query_foo" => "bar"}, snaky: false)
|
|
@@ -584,6 +692,22 @@ Response instance will contain the `OAuth2::Error` instance.
|
|
|
584
692
|
|
|
585
693
|
### Authorization Grants
|
|
586
694
|
|
|
695
|
+
Note on OAuth 2.1 (draft):
|
|
696
|
+
- PKCE is required for all OAuth clients using the authorization code flow (especially public clients). Implement PKCE in your app when required by your provider. See RFC 7636 and RFC 8252.
|
|
697
|
+
- Redirect URIs must be compared using exact string matching by the Authorization Server.
|
|
698
|
+
- The Implicit grant (response_type=token) and the Resource Owner Password Credentials grant are omitted from OAuth 2.1; they remain here for OAuth 2.0 compatibility but should be avoided for new apps.
|
|
699
|
+
- Bearer tokens in the query string are omitted due to security risks; prefer Authorization header usage.
|
|
700
|
+
- Refresh tokens for public clients must either be sender-constrained (e.g., DPoP/MTLS) or one-time use.
|
|
701
|
+
- The definitions of public and confidential clients are simplified to refer only to whether the client has credentials.
|
|
702
|
+
|
|
703
|
+
References:
|
|
704
|
+
- OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13
|
|
705
|
+
- Aaron Parecki: https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1
|
|
706
|
+
- FusionAuth: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1
|
|
707
|
+
- Okta: https://developer.okta.com/blog/2019/12/13/oauth-2-1-how-many-rfcs
|
|
708
|
+
- Video: https://www.youtube.com/watch?v=g_aVPdwBTfw
|
|
709
|
+
- Differences overview: https://fusionauth.io/learn/expert-advice/oauth/differences-between-oauth-2-oauth-2-1/
|
|
710
|
+
|
|
587
711
|
Currently, the Authorization Code, Implicit, Resource Owner Password Credentials, Client Credentials, and Assertion
|
|
588
712
|
authentication grant types have helper strategy classes that simplify client
|
|
589
713
|
use. They are available via the [`#auth_code`](https://gitlab.com/ruby-oauth/oauth2/-/blob/main/lib/oauth2/strategy/auth_code.rb),
|
|
@@ -674,6 +798,55 @@ resp = access.get("/v1/things")
|
|
|
674
798
|
access = client.password.get_token("jdoe", "s3cret", scope: "read")
|
|
675
799
|
```
|
|
676
800
|
|
|
801
|
+
#### Examples
|
|
802
|
+
|
|
803
|
+
<details>
|
|
804
|
+
<summary>JHipster UAA (Spring Cloud) password grant example (legacy; avoid when possible)</summary>
|
|
805
|
+
|
|
806
|
+
```ruby
|
|
807
|
+
# This converts a Postman/Net::HTTP multipart token request to oauth2 gem usage.
|
|
808
|
+
# JHipster UAA typically exposes the token endpoint at /uaa/oauth/token.
|
|
809
|
+
# The original snippet included:
|
|
810
|
+
# - Basic Authorization header for the client (web_app:changeit)
|
|
811
|
+
# - X-XSRF-TOKEN header from a cookie (some deployments require it)
|
|
812
|
+
# - grant_type=password with username/password and client_id
|
|
813
|
+
# Using oauth2 gem, you don't need to build multipart bodies; the gem sends
|
|
814
|
+
# application/x-www-form-urlencoded as required by RFC 6749.
|
|
815
|
+
|
|
816
|
+
require "oauth2"
|
|
817
|
+
|
|
818
|
+
client = OAuth2::Client.new(
|
|
819
|
+
"web_app", # client_id
|
|
820
|
+
"changeit", # client_secret
|
|
821
|
+
site: "http://localhost:8080/uaa",
|
|
822
|
+
token_url: "/oauth/token", # absolute under site (or "oauth/token" relative)
|
|
823
|
+
auth_scheme: :basic_auth, # sends HTTP Basic Authorization header
|
|
824
|
+
)
|
|
825
|
+
|
|
826
|
+
# If your UAA requires an XSRF header for the token call, provide it as a header.
|
|
827
|
+
# Often this is not required for token endpoints, but if your gateway enforces it,
|
|
828
|
+
# obtain the value from the XSRF-TOKEN cookie and pass it here.
|
|
829
|
+
xsrf_token = ENV["X_XSRF_TOKEN"] # e.g., pulled from a prior set-cookie value
|
|
830
|
+
|
|
831
|
+
access = client.password.get_token(
|
|
832
|
+
"admin", # username
|
|
833
|
+
"admin", # password
|
|
834
|
+
headers: xsrf_token ? {"X-XSRF-TOKEN" => xsrf_token} : {},
|
|
835
|
+
# JHipster commonly also accepts/needs the client_id in the body; include if required:
|
|
836
|
+
# client_id: "web_app",
|
|
837
|
+
)
|
|
838
|
+
|
|
839
|
+
puts access.token
|
|
840
|
+
puts access.to_hash # full token response
|
|
841
|
+
```
|
|
842
|
+
|
|
843
|
+
Notes:
|
|
844
|
+
- Resource Owner Password Credentials (ROPC) is deprecated in OAuth 2.1 and discouraged. Prefer Authorization Code + PKCE.
|
|
845
|
+
- If your deployment strictly demands the X-XSRF-TOKEN header, first fetch it from an endpoint that sets the XSRF-TOKEN cookie (often "/" or a login page) and pass it to headers.
|
|
846
|
+
- For Basic auth, auth_scheme: :basic_auth handles the Authorization header; you do not need to base64-encode manually.
|
|
847
|
+
|
|
848
|
+
</details>
|
|
849
|
+
|
|
677
850
|
### Refresh Tokens
|
|
678
851
|
|
|
679
852
|
When the server issues a refresh_token, you can refresh manually or implement an auto-refresh wrapper.
|
|
@@ -740,7 +913,55 @@ access.revoke(token_type_hint: :refresh_token)
|
|
|
740
913
|
|
|
741
914
|
### Client Configuration Tips
|
|
742
915
|
|
|
743
|
-
|
|
916
|
+
#### Mutual TLS (mTLS) client authentication
|
|
917
|
+
|
|
918
|
+
Some providers require OAuth requests (including the token request and subsequent API calls) to be sender‑constrained using mutual TLS (mTLS). With this gem, you enable mTLS by providing a client certificate/private key to Faraday via connection_opts.ssl and, if your provider requires it for client authentication, selecting the tls_client_auth auth_scheme.
|
|
919
|
+
|
|
920
|
+
Example using PEM files (certificate and key):
|
|
921
|
+
|
|
922
|
+
```ruby
|
|
923
|
+
require "oauth2"
|
|
924
|
+
require "openssl"
|
|
925
|
+
|
|
926
|
+
client = OAuth2::Client.new(
|
|
927
|
+
ENV.fetch("CLIENT_ID"),
|
|
928
|
+
ENV.fetch("CLIENT_SECRET"),
|
|
929
|
+
site: "https://example.com",
|
|
930
|
+
authorize_url: "/oauth/authorize/",
|
|
931
|
+
token_url: "/oauth/token/",
|
|
932
|
+
auth_scheme: :tls_client_auth, # if your AS requires mTLS-based client authentication
|
|
933
|
+
connection_opts: {
|
|
934
|
+
ssl: {
|
|
935
|
+
client_cert: OpenSSL::X509::Certificate.new(File.read("localhost.pem")),
|
|
936
|
+
client_key: OpenSSL::PKey::RSA.new(File.read("localhost-key.pem")),
|
|
937
|
+
# Optional extras, uncomment as needed:
|
|
938
|
+
# ca_file: "/path/to/ca-bundle.pem", # custom CA(s)
|
|
939
|
+
# verify: true # enable server cert verification (recommended)
|
|
940
|
+
},
|
|
941
|
+
},
|
|
942
|
+
)
|
|
943
|
+
|
|
944
|
+
# Example token request (any grant type can be used). The mTLS handshake
|
|
945
|
+
# will occur automatically on HTTPS calls using the configured cert/key.
|
|
946
|
+
access = client.client_credentials.get_token
|
|
947
|
+
|
|
948
|
+
# Subsequent resource requests will also use mTLS on HTTPS endpoints of `site`:
|
|
949
|
+
resp = access.get("/v1/protected")
|
|
950
|
+
```
|
|
951
|
+
|
|
952
|
+
Notes:
|
|
953
|
+
- Files must contain the appropriate PEMs. The private key may be encrypted; if so, pass a password to OpenSSL::PKey::RSA.new(File.read(path), ENV["KEY_PASSWORD"]).
|
|
954
|
+
- If your certificate and key are in a PKCS#12/PFX bundle, you can load them like:
|
|
955
|
+
- p12 = OpenSSL::PKCS12.new(File.read("client.p12"), ENV["P12_PASSWORD"])
|
|
956
|
+
- client_cert = p12.certificate; client_key = p12.key
|
|
957
|
+
- Server trust:
|
|
958
|
+
- If your environment does not have system CAs, specify ca_file or ca_path inside the ssl: hash.
|
|
959
|
+
- Keep verify: true in production. Set verify: false only for local testing.
|
|
960
|
+
- Faraday adapter: Any adapter that supports Ruby’s OpenSSL should work. net_http (default) and net_http_persistent are common choices.
|
|
961
|
+
- Scope of mTLS: The SSL client cert is applied to any HTTPS request made by this client (token and resource requests) to the configured site base URL (and absolute URLs you call with the same client).
|
|
962
|
+
- OIDC tie-in: Some OPs require tls_client_auth at the token endpoint per OIDC/OAuth specifications. That is enabled via auth_scheme: :tls_client_auth as shown above.
|
|
963
|
+
|
|
964
|
+
#### Authentication schemes for the token request
|
|
744
965
|
|
|
745
966
|
```ruby
|
|
746
967
|
OAuth2::Client.new(
|
|
@@ -751,7 +972,7 @@ OAuth2::Client.new(
|
|
|
751
972
|
)
|
|
752
973
|
```
|
|
753
974
|
|
|
754
|
-
|
|
975
|
+
#### Faraday connection, timeouts, proxy, custom adapter/middleware:
|
|
755
976
|
|
|
756
977
|
```ruby
|
|
757
978
|
client = OAuth2::Client.new(
|
|
@@ -770,7 +991,52 @@ client = OAuth2::Client.new(
|
|
|
770
991
|
end
|
|
771
992
|
```
|
|
772
993
|
|
|
773
|
-
|
|
994
|
+
##### Using flat query params (Faraday::FlatParamsEncoder)
|
|
995
|
+
|
|
996
|
+
Some APIs expect repeated key parameters to be sent as flat params rather than arrays. Faraday provides FlatParamsEncoder for this purpose. You can configure the oauth2 client to use it when building requests.
|
|
997
|
+
|
|
998
|
+
```ruby
|
|
999
|
+
require "faraday"
|
|
1000
|
+
|
|
1001
|
+
client = OAuth2::Client.new(
|
|
1002
|
+
id,
|
|
1003
|
+
secret,
|
|
1004
|
+
site: "https://api.example.com",
|
|
1005
|
+
# Pass Faraday connection options to make FlatParamsEncoder the default
|
|
1006
|
+
connection_opts: {
|
|
1007
|
+
request: {params_encoder: Faraday::FlatParamsEncoder},
|
|
1008
|
+
},
|
|
1009
|
+
) do |faraday|
|
|
1010
|
+
faraday.request(:url_encoded)
|
|
1011
|
+
faraday.adapter(:net_http)
|
|
1012
|
+
end
|
|
1013
|
+
|
|
1014
|
+
access = client.client_credentials.get_token
|
|
1015
|
+
|
|
1016
|
+
# Example of a GET with two flat filter params (not an array):
|
|
1017
|
+
# Results in: ?filter=order.clientCreatedTime%3E1445006997000&filter=order.clientCreatedTime%3C1445611797000
|
|
1018
|
+
resp = access.get(
|
|
1019
|
+
"/v1/orders",
|
|
1020
|
+
params: {
|
|
1021
|
+
# Provide the values as an array; FlatParamsEncoder expands them as repeated keys
|
|
1022
|
+
filter: [
|
|
1023
|
+
"order.clientCreatedTime>1445006997000",
|
|
1024
|
+
"order.clientCreatedTime<1445611797000",
|
|
1025
|
+
],
|
|
1026
|
+
},
|
|
1027
|
+
)
|
|
1028
|
+
```
|
|
1029
|
+
|
|
1030
|
+
If you instead need to build a raw Faraday connection yourself, the equivalent configuration is:
|
|
1031
|
+
|
|
1032
|
+
```ruby
|
|
1033
|
+
conn = Faraday.new("https://api.example.com", request: {params_encoder: Faraday::FlatParamsEncoder})
|
|
1034
|
+
```
|
|
1035
|
+
|
|
1036
|
+
#### Redirection
|
|
1037
|
+
|
|
1038
|
+
The library follows up to `max_redirects` (default 5).
|
|
1039
|
+
You can override per-client via `options[:max_redirects]`.
|
|
774
1040
|
|
|
775
1041
|
### Handling Responses and Errors
|
|
776
1042
|
|
|
@@ -823,6 +1089,7 @@ access = client.get_token({
|
|
|
823
1089
|
|
|
824
1090
|
- If the token response includes an `id_token` (a JWT), this gem surfaces it but does not validate the signature. Use a JWT library and your provider's JWKs to verify it.
|
|
825
1091
|
- For private_key_jwt client authentication, provide `auth_scheme: :private_key_jwt` and ensure your key configuration matches the provider requirements.
|
|
1092
|
+
- See [OIDC.md](OIDC.md) for a more complete OIDC overview, example, and links to the relevant specifications.
|
|
826
1093
|
|
|
827
1094
|
### Debugging
|
|
828
1095
|
|
|
@@ -887,7 +1154,10 @@ I’m developing a new library, [floss_funding][🖇floss-funding-gem], designed
|
|
|
887
1154
|
|
|
888
1155
|
## 🔐 Security
|
|
889
1156
|
|
|
890
|
-
|
|
1157
|
+
To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security).
|
|
1158
|
+
Tidelift will coordinate the fix and disclosure.
|
|
1159
|
+
|
|
1160
|
+
For more see [SECURITY.md][🔐security].
|
|
891
1161
|
|
|
892
1162
|
## 🤝 Contributing
|
|
893
1163
|
|
|
@@ -1067,7 +1337,7 @@ Thanks for RTFM. ☺️
|
|
|
1067
1337
|
[🚂maint-contact-img]: https://img.shields.io/badge/Contact-Maintainer-0093D0.svg?style=flat&logo=rubyonrails&logoColor=red
|
|
1068
1338
|
[💖🖇linkedin]: http://www.linkedin.com/in/peterboling
|
|
1069
1339
|
[💖🖇linkedin-img]: https://img.shields.io/badge/PeterBoling-LinkedIn-0B66C2?style=flat&logo=newjapanprowrestling
|
|
1070
|
-
[💖✌️wellfound]: https://wellfound.com/u/peter-boling
|
|
1340
|
+
[💖✌️wellfound]: https://wellfound.com/u/peter-boling
|
|
1071
1341
|
[💖✌️wellfound-img]: https://img.shields.io/badge/peter--boling-orange?style=flat&logo=wellfound
|
|
1072
1342
|
[💖💲crunchbase]: https://www.crunchbase.com/person/peter-boling
|
|
1073
1343
|
[💖💲crunchbase-img]: https://img.shields.io/badge/peter--boling-purple?style=flat&logo=crunchbase
|
data/lib/oauth2/access_token.rb
CHANGED
|
@@ -376,6 +376,8 @@ You may need to set `snaky: false`. See inline documentation for more info.
|
|
|
376
376
|
opts[:headers] ||= {}
|
|
377
377
|
opts[:headers].merge!(headers)
|
|
378
378
|
when :query
|
|
379
|
+
# OAuth 2.1 note: Bearer tokens in the query string are omitted from the spec due to security risks.
|
|
380
|
+
# Prefer the default :header mode whenever possible.
|
|
379
381
|
opts[:params] ||= {}
|
|
380
382
|
opts[:params][options[:param_name]] = token
|
|
381
383
|
when :body
|
data/lib/oauth2/client.rb
CHANGED
|
@@ -321,6 +321,9 @@ module OAuth2
|
|
|
321
321
|
# requesting authorization. If it is provided at authorization time it MUST
|
|
322
322
|
# also be provided with the token exchange request.
|
|
323
323
|
#
|
|
324
|
+
# OAuth 2.1 note: Authorization Servers must compare redirect URIs using exact string matching.
|
|
325
|
+
# This client simply forwards the configured redirect_uri; the exact-match validation happens server-side.
|
|
326
|
+
#
|
|
324
327
|
# Providing :redirect_uri to the OAuth2::Client instantiation will take
|
|
325
328
|
# care of managing this.
|
|
326
329
|
#
|
|
@@ -330,6 +333,7 @@ module OAuth2
|
|
|
330
333
|
# @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3
|
|
331
334
|
# @see https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.1
|
|
332
335
|
# @see https://datatracker.ietf.org/doc/html/rfc6749#section-10.6
|
|
336
|
+
# @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13
|
|
333
337
|
#
|
|
334
338
|
# @return [Hash] the params to add to a request or URL
|
|
335
339
|
def redirection_params
|
|
@@ -4,6 +4,16 @@ module OAuth2
|
|
|
4
4
|
module Strategy
|
|
5
5
|
# The Authorization Code Strategy
|
|
6
6
|
#
|
|
7
|
+
# OAuth 2.1 notes:
|
|
8
|
+
# - PKCE is required for all OAuth clients using the authorization code flow (especially public clients).
|
|
9
|
+
# This library does not enforce PKCE generation/verification; implement PKCE in your application when required.
|
|
10
|
+
# - Redirect URIs must be compared using exact string matching by the Authorization Server.
|
|
11
|
+
# This client forwards redirect_uri but does not perform server-side validation.
|
|
12
|
+
#
|
|
13
|
+
# References:
|
|
14
|
+
# - OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13
|
|
15
|
+
# - OAuth for native apps (RFC 8252) and PKCE (RFC 7636)
|
|
16
|
+
#
|
|
7
17
|
# @see http://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-15#section-4.1
|
|
8
18
|
class AuthCode < Base
|
|
9
19
|
# The required query parameters for the authorize URL
|
|
@@ -4,6 +4,14 @@ module OAuth2
|
|
|
4
4
|
module Strategy
|
|
5
5
|
# The Implicit Strategy
|
|
6
6
|
#
|
|
7
|
+
# IMPORTANT (OAuth 2.1): The Implicit grant (response_type=token) is omitted from the OAuth 2.1 draft specification.
|
|
8
|
+
# It remains here for backward compatibility with OAuth 2.0 providers. Prefer the Authorization Code flow with PKCE.
|
|
9
|
+
#
|
|
10
|
+
# References:
|
|
11
|
+
# - OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13
|
|
12
|
+
# - Why drop implicit: https://aaronparecki.com/2019/12/12/21/its-time-for-oauth-2-dot-1
|
|
13
|
+
# - Background: https://fusionauth.io/learn/expert-advice/oauth/differences-between-oauth-2-oauth-2-1/
|
|
14
|
+
#
|
|
7
15
|
# @see http://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-26#section-4.2
|
|
8
16
|
class Implicit < Base
|
|
9
17
|
# The required query parameters for the authorize URL
|
|
@@ -4,6 +4,14 @@ module OAuth2
|
|
|
4
4
|
module Strategy
|
|
5
5
|
# The Resource Owner Password Credentials Authorization Strategy
|
|
6
6
|
#
|
|
7
|
+
# IMPORTANT (OAuth 2.1): The Resource Owner Password Credentials grant is omitted in OAuth 2.1.
|
|
8
|
+
# It remains here for backward compatibility with OAuth 2.0 providers. Prefer Authorization Code + PKCE.
|
|
9
|
+
#
|
|
10
|
+
# References:
|
|
11
|
+
# - OAuth 2.1 draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13
|
|
12
|
+
# - Okta explainer: https://developer.okta.com/blog/2019/12/13/oauth-2-1-how-many-rfcs
|
|
13
|
+
# - FusionAuth blog: https://fusionauth.io/blog/2020/04/15/whats-new-in-oauth-2-1
|
|
14
|
+
#
|
|
7
15
|
# @see http://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-15#section-4.3
|
|
8
16
|
class Password < Base
|
|
9
17
|
# Not used for this strategy
|
data/lib/oauth2/version.rb
CHANGED
data.tar.gz.sig
CHANGED
|
Binary file
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: oauth2
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 2.0.
|
|
4
|
+
version: 2.0.14
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Peter Boling
|
|
@@ -216,7 +216,7 @@ dependencies:
|
|
|
216
216
|
version: '1.0'
|
|
217
217
|
- - ">="
|
|
218
218
|
- !ruby/object:Gem::Version
|
|
219
|
-
version: 1.0.
|
|
219
|
+
version: 1.0.24
|
|
220
220
|
type: :development
|
|
221
221
|
prerelease: false
|
|
222
222
|
version_requirements: !ruby/object:Gem::Requirement
|
|
@@ -226,7 +226,7 @@ dependencies:
|
|
|
226
226
|
version: '1.0'
|
|
227
227
|
- - ">="
|
|
228
228
|
- !ruby/object:Gem::Version
|
|
229
|
-
version: 1.0.
|
|
229
|
+
version: 1.0.24
|
|
230
230
|
- !ruby/object:Gem::Dependency
|
|
231
231
|
name: nkf
|
|
232
232
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -274,6 +274,7 @@ extra_rdoc_files:
|
|
|
274
274
|
- CONTRIBUTING.md
|
|
275
275
|
- FUNDING.md
|
|
276
276
|
- LICENSE.txt
|
|
277
|
+
- OIDC.md
|
|
277
278
|
- README.md
|
|
278
279
|
- REEK
|
|
279
280
|
- RUBOCOP.md
|
|
@@ -285,6 +286,7 @@ files:
|
|
|
285
286
|
- CONTRIBUTING.md
|
|
286
287
|
- FUNDING.md
|
|
287
288
|
- LICENSE.txt
|
|
289
|
+
- OIDC.md
|
|
288
290
|
- README.md
|
|
289
291
|
- REEK
|
|
290
292
|
- RUBOCOP.md
|
|
@@ -317,10 +319,10 @@ licenses:
|
|
|
317
319
|
- MIT
|
|
318
320
|
metadata:
|
|
319
321
|
homepage_uri: https://oauth2.galtzo.com/
|
|
320
|
-
source_code_uri: https://github.com/ruby-oauth/oauth2/tree/v2.0.
|
|
321
|
-
changelog_uri: https://github.com/ruby-oauth/oauth2/blob/v2.0.
|
|
322
|
+
source_code_uri: https://github.com/ruby-oauth/oauth2/tree/v2.0.14
|
|
323
|
+
changelog_uri: https://github.com/ruby-oauth/oauth2/blob/v2.0.14/CHANGELOG.md
|
|
322
324
|
bug_tracker_uri: https://github.com/ruby-oauth/oauth2/issues
|
|
323
|
-
documentation_uri: https://www.rubydoc.info/gems/oauth2/2.0.
|
|
325
|
+
documentation_uri: https://www.rubydoc.info/gems/oauth2/2.0.14
|
|
324
326
|
mailing_list_uri: https://groups.google.com/g/oauth-ruby
|
|
325
327
|
funding_uri: https://github.com/sponsors/pboling
|
|
326
328
|
wiki_uri: https://gitlab.com/ruby-oauth/oauth2/-/wiki
|
|
@@ -329,14 +331,14 @@ metadata:
|
|
|
329
331
|
rubygems_mfa_required: 'true'
|
|
330
332
|
post_install_message: |2
|
|
331
333
|
|
|
332
|
-
---+++--- oauth2 v2.0.
|
|
334
|
+
---+++--- oauth2 v2.0.14 ---+++---
|
|
333
335
|
|
|
334
336
|
(minor) ⚠️ BREAKING CHANGES ⚠️ when upgrading from < v2
|
|
335
337
|
• Summary of breaking changes: https://gitlab.com/ruby-oauth/oauth2#what-is-new-for-v20
|
|
336
|
-
• Changes in this patch: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.
|
|
338
|
+
• Changes in this patch: https://gitlab.com/ruby-oauth/oauth2/-/blob/v2.0.14/CHANGELOG.md#200-2022-06-21-tag
|
|
337
339
|
|
|
338
340
|
News:
|
|
339
|
-
1. New documentation website: https://oauth2.galtzo.com
|
|
341
|
+
1. New documentation website, including for OAuth 2.1 and OIDC: https://oauth2.galtzo.com
|
|
340
342
|
2. New official Discord for discussion and support: https://discord.gg/3qme4XHNKN
|
|
341
343
|
3. New org name "ruby-oauth" on Open Source Collective, GitHub, GitLab, Codeberg (update git remotes!)
|
|
342
344
|
4. Non-commercial support for the 2.x series will end by April, 2026. Please make a plan to upgrade to the next version prior to that date.
|
metadata.gz.sig
CHANGED
|
Binary file
|