openid-token-proxy 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 367c9b989127b83d27046b97d8d0eed4bb62bc26
-  data.tar.gz: 0f5b072253012066745622211b7176ba24a797d7
+  metadata.gz: a6d5534b9ef67edc50b5003b4d7a70cf1fb4382e
+  data.tar.gz: 67c985af3debaa56cd7cfa17e34fe15433b5ff0e
 SHA512:
-  metadata.gz: 61558da5b310ec2fb8322b1d8011d5b6df5081e6943f95c70e8c73685fdda3047d67252a57bf9efc220403f78e4d4a75910fab19589feb57fcba2f1187501ccb
-  data.tar.gz: 4fca1eff9249fa10be128a1874da69aa82f08feb4bddbda93df17e6af75c192e761eb2f735befe3cbe1410e9b44f1c9609c2e5982b6b0c44205ea9b8f496f5ee
+  metadata.gz: 6bab4ffceb974e02ab030cadee28b0724fedf4efa2fe82bae676a629401e500dbc6334dad2ca8a70557f8f39a1fef799ec9cb2a51a5f9bdcf693c05e843def7b
+  data.tar.gz: 55e5f7efe285331a331d47deebeed8d11843ca4b10d54bb2f631697fb3433b069dd5f05bd450d519414382900705c30ed3218747c8543370dd9e7603ae0d1137

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+### v0.1.2 - May 18, 2015
+
+- Allow overriding `CallbackController`.
+
+
 ### v0.1.1 - May 12, 2015
 
 - Token expiry time is exposed through `X-Token-Expiry-Time` header.

data/README.md

@@ -125,6 +125,8 @@ OpenIDTokenProxy.configure do |config|
 end
 ```
 
+**Warning**: Redirecting to any path with query parameters (e.g. `example.com/?token=xxx`) could theoretically leak tokens to third parties through the `Referer`-header for external assets.
+
 
 ### Token authentication
 

data/app/controllers/openid_token_proxy/callback_controller.rb

@@ -1,22 +1,5 @@
 module OpenIDTokenProxy
   class CallbackController < ApplicationController
-    def handle
-      unless code = params[:code]
-        render text: "Required parameter 'code' missing.", status: :bad_request
-        return
-      end
-
-      begin
-        token = OpenIDTokenProxy.client.retrieve_token!(auth_code: code)
-      rescue OpenIDTokenProxy::Client::AuthCodeError => error
-        render text: "Could not exchange authorization code: #{error.message}.",
-               status: :bad_request
-        return
-      end
-
-      config = OpenIDTokenProxy.config
-      uri = instance_exec token, &config.token_acquirement_hook
-      redirect_to uri || main_app.root_url unless performed?
-    end
+    include OpenIDTokenProxy::Concerns::CallbackController
   end
 end

data/lib/openid_token_proxy.rb

@@ -5,6 +5,7 @@ require 'openid_connect'
 require 'openid_token_proxy/error'
 
 require 'openid_token_proxy/client'
+require 'openid_token_proxy/concerns/callback_controller'
 require 'openid_token_proxy/config'
 require 'openid_token_proxy/engine'
 require 'openid_token_proxy/token'

data/lib/openid_token_proxy/concerns/callback_controller.rb

@@ -0,0 +1,26 @@
+module OpenIDTokenProxy
+  module Concerns
+    module CallbackController
+      extend ActiveSupport::Concern
+
+      def handle
+        unless code = params[:code]
+          render text: "Required parameter 'code' missing.", status: :bad_request
+          return
+        end
+
+        begin
+          token = OpenIDTokenProxy.client.retrieve_token!(auth_code: code)
+        rescue OpenIDTokenProxy::Client::AuthCodeError => error
+          render text: "Could not exchange authorization code: #{error.message}.",
+                 status: :bad_request
+          return
+        end
+
+        config = OpenIDTokenProxy.config
+        uri = instance_exec token, &config.token_acquirement_hook
+        redirect_to uri || main_app.root_url unless performed?
+      end
+    end
+  end
+end

data/lib/openid_token_proxy/token/authentication.rb

@@ -1,5 +1,3 @@
-require 'active_support/concern'
-
 module OpenIDTokenProxy
   class Token
     module Authentication

data/lib/openid_token_proxy/token/refresh.rb

@@ -1,5 +1,3 @@
-require 'active_support/concern'
-
 module OpenIDTokenProxy
   class Token
     module Refresh

data/lib/openid_token_proxy/version.rb

@@ -1,3 +1,3 @@
 module OpenIDTokenProxy
-  VERSION = '0.1.1'
+  VERSION = '0.1.2'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: openid-token-proxy
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Tim Kurvers
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-05-12 00:00:00.000000000 Z
+date: 2015-05-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: openid_connect
@@ -205,6 +205,7 @@ files:
 - lib/openid-token-proxy.rb
 - lib/openid_token_proxy.rb
 - lib/openid_token_proxy/client.rb
+- lib/openid_token_proxy/concerns/callback_controller.rb
 - lib/openid_token_proxy/config.rb
 - lib/openid_token_proxy/engine.rb
 - lib/openid_token_proxy/error.rb