rack-oauth2 0.3.0 → 0.3.1
Sign up to get free protection for your applications and to get access to all the features.
- data/README.rdoc +7 -21
- data/VERSION +1 -1
- data/lib/rack/oauth2/server/authorize/error.rb +2 -2
- data/lib/rack/oauth2/server/authorize.rb +10 -5
- data/lib/rack/oauth2/server/util.rb +5 -5
- data/spec/rack/oauth2/server/authorize/code_spec.rb +1 -0
- data/spec/rack/oauth2/server/authorize/token_spec.rb +1 -0
- data/spec/rack/oauth2/server/authorize_spec.rb +6 -4
- data/spec/rack/oauth2/server/util_spec.rb +8 -8
- metadata +4 -4
data/README.rdoc
CHANGED
@@ -2,8 +2,8 @@
|
|
2
2
|
|
3
3
|
Rack Middleware for OAuth2. Currently support only Server/Provider, not Client/Consumer.
|
4
4
|
|
5
|
-
This gem is based on OAuth 2.0 draft v.
|
6
|
-
http://tools.ietf.org/html/draft-ietf-oauth-v2-
|
5
|
+
This gem is based on OAuth 2.0 draft v.13
|
6
|
+
http://tools.ietf.org/html/draft-ietf-oauth-v2-13
|
7
7
|
|
8
8
|
== Installation
|
9
9
|
|
@@ -16,27 +16,13 @@ http://tools.ietf.org/html/draft-ietf-oauth-v2-10
|
|
16
16
|
* Report Issues on GitHub (http://github.com/nov/rack-oauth2/issues)
|
17
17
|
* Facebook Page (http://www.facebook.com/pages/RackOAuth2/141477809244105)
|
18
18
|
|
19
|
-
==
|
19
|
+
== Sample Application (Rails3)
|
20
20
|
|
21
|
-
|
21
|
+
Running on Heroku
|
22
|
+
http://rack-oauth2-sample.heroku.com
|
22
23
|
|
23
|
-
|
24
|
-
|
25
|
-
http://gist.github.com/584594
|
26
|
-
|
27
|
-
==== Protected Resource Middleware Setting
|
28
|
-
|
29
|
-
http://gist.github.com/584565
|
30
|
-
|
31
|
-
=== Sinatra
|
32
|
-
|
33
|
-
==== Resource Owner Authorization Endpoint
|
34
|
-
|
35
|
-
http://gist.github.com/584595
|
36
|
-
|
37
|
-
==== Token Endpoint
|
38
|
-
|
39
|
-
http://gist.github.com/584574
|
24
|
+
Source on GitHub
|
25
|
+
http://github.com/nov/rack-oauth2-sample
|
40
26
|
|
41
27
|
== Note on Patches/Pull Requests
|
42
28
|
|
data/VERSION
CHANGED
@@ -1 +1 @@
|
|
1
|
-
0.3.
|
1
|
+
0.3.1
|
@@ -33,7 +33,7 @@ module Rack
|
|
33
33
|
DEFAULT_DESCRIPTION.each do |error, default_description|
|
34
34
|
klass.class_eval <<-ERROR
|
35
35
|
def #{error}!(description = "#{default_description}", options = {})
|
36
|
-
bad_request! :#{error}, description, options
|
36
|
+
bad_request! :#{error}, description, options
|
37
37
|
end
|
38
38
|
ERROR
|
39
39
|
end
|
@@ -48,7 +48,7 @@ module Rack
|
|
48
48
|
:fragment
|
49
49
|
end
|
50
50
|
exception.state = state
|
51
|
-
exception.redirect_uri =
|
51
|
+
exception.redirect_uri = verified_redirect_uri
|
52
52
|
raise exception
|
53
53
|
end
|
54
54
|
end
|
@@ -12,6 +12,7 @@ module Rack
|
|
12
12
|
class Request < Abstract::Request
|
13
13
|
attr_required :response_type
|
14
14
|
attr_optional :redirect_uri, :state
|
15
|
+
attr_reader :verified_redirect_uri
|
15
16
|
|
16
17
|
def initialize(env)
|
17
18
|
super
|
@@ -34,13 +35,17 @@ module Rack
|
|
34
35
|
end
|
35
36
|
end
|
36
37
|
|
37
|
-
def
|
38
|
-
|
39
|
-
redirect_uri
|
38
|
+
def verify_redirect_uri!(pre_registered)
|
39
|
+
@verified_redirect_uri = if redirect_uri.present?
|
40
|
+
if Util.uri_match?(pre_registered, redirect_uri)
|
41
|
+
redirect_uri
|
42
|
+
else
|
43
|
+
bad_request!
|
44
|
+
end
|
40
45
|
else
|
41
|
-
|
46
|
+
pre_registered
|
42
47
|
end
|
43
|
-
|
48
|
+
self.verified_redirect_uri.to_s
|
44
49
|
end
|
45
50
|
end
|
46
51
|
|
@@ -31,14 +31,14 @@ module Rack
|
|
31
31
|
redirect_uri.to_s
|
32
32
|
end
|
33
33
|
|
34
|
-
def
|
35
|
-
|
34
|
+
def uri_match?(base, given)
|
35
|
+
base = parse_uri(base)
|
36
36
|
given = parse_uri(given)
|
37
|
-
|
37
|
+
base.path = '/' if base.path.blank?
|
38
38
|
given.path = '/' if given.path.blank?
|
39
39
|
[:scheme, :host, :port].all? do |key|
|
40
|
-
|
41
|
-
end && /^#{
|
40
|
+
base.send(key) == given.send(key)
|
41
|
+
end && /^#{base.path}/ =~ given.path
|
42
42
|
rescue
|
43
43
|
false
|
44
44
|
end
|
@@ -50,21 +50,23 @@ describe Rack::OAuth2::Server::Authorize do
|
|
50
50
|
describe '#varified_redirect_uri' do
|
51
51
|
context 'when valid redirect_uri is given' do
|
52
52
|
it 'should use given redirect_uri' do
|
53
|
-
request.
|
53
|
+
request.verify_redirect_uri!(pre_registered).should == redirect_uri
|
54
54
|
end
|
55
55
|
end
|
56
56
|
|
57
57
|
context 'when invalid redirect_uri is given' do
|
58
58
|
let(:pre_registered) { 'http://client2.example.com' }
|
59
|
-
it
|
60
|
-
|
59
|
+
it do
|
60
|
+
expect do
|
61
|
+
request.verify_redirect_uri!(pre_registered).should == pre_registered
|
62
|
+
end.should raise_error Rack::OAuth2::Server::Authorize::BadRequest
|
61
63
|
end
|
62
64
|
end
|
63
65
|
|
64
66
|
context 'when redirect_uri is missing' do
|
65
67
|
let(:env) { Rack::MockRequest.env_for("/authorize?client_id=client") }
|
66
68
|
it 'should use pre-registered redirect_uri' do
|
67
|
-
request.
|
69
|
+
request.verify_redirect_uri!(pre_registered).should == pre_registered
|
68
70
|
end
|
69
71
|
end
|
70
72
|
end
|
@@ -60,27 +60,27 @@ describe Rack::OAuth2::Server::Util do
|
|
60
60
|
end
|
61
61
|
end
|
62
62
|
|
63
|
-
describe '.
|
63
|
+
describe '.uri_match?' do
|
64
64
|
context 'when invalid URI is given' do
|
65
65
|
it do
|
66
|
-
util.
|
67
|
-
util.
|
68
|
-
util.
|
66
|
+
util.uri_match?('::', '::').should be_false
|
67
|
+
util.uri_match?(123, 'http://client.example.com/other').should be_false
|
68
|
+
util.uri_match?('http://client.example.com/other', nil).should be_false
|
69
69
|
end
|
70
70
|
end
|
71
71
|
|
72
72
|
context 'when exactry same' do
|
73
|
-
it { util.
|
73
|
+
it { util.uri_match?(uri, uri).should be_true }
|
74
74
|
end
|
75
75
|
|
76
76
|
context 'when path prefix matches' do
|
77
|
-
it { util.
|
77
|
+
it { util.uri_match?(uri, "#{uri}/deep_path").should be_true }
|
78
78
|
end
|
79
79
|
|
80
80
|
context 'otherwise' do
|
81
81
|
it do
|
82
|
-
util.
|
83
|
-
util.
|
82
|
+
util.uri_match?(uri, 'http://client.example.com/other').should be_false
|
83
|
+
util.uri_match?(uri, 'http://attacker.example.com/callback').should be_false
|
84
84
|
end
|
85
85
|
end
|
86
86
|
end
|
metadata
CHANGED
@@ -1,13 +1,13 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: rack-oauth2
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
hash:
|
4
|
+
hash: 17
|
5
5
|
prerelease:
|
6
6
|
segments:
|
7
7
|
- 0
|
8
8
|
- 3
|
9
|
-
-
|
10
|
-
version: 0.3.
|
9
|
+
- 1
|
10
|
+
version: 0.3.1
|
11
11
|
platform: ruby
|
12
12
|
authors:
|
13
13
|
- nov matake
|
@@ -15,7 +15,7 @@ autorequire:
|
|
15
15
|
bindir: bin
|
16
16
|
cert_chain: []
|
17
17
|
|
18
|
-
date: 2011-03-
|
18
|
+
date: 2011-03-07 00:00:00 +09:00
|
19
19
|
default_executable:
|
20
20
|
dependencies:
|
21
21
|
- !ruby/object:Gem::Dependency
|