rodauth-oauth 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8288f66a0f7dd5400b60d2508a0247aefd37f1aa73322c19bf3b744d3e8b1ace
-  data.tar.gz: 6f2c333c4c2c3a4f92544f939ac1112d31c78a56779f22234bb7e7ce95105931
+  metadata.gz: 12c86242a8a2001fba629cb6bd8e25886b8805fce5d0965ebc70377824e25e91
+  data.tar.gz: 2fdc78f81b737c9c0d0086f258a86807f8855d3f0bc9be89bffb6d6a90946ed3
 SHA512:
-  metadata.gz: 612b2651b4c29f98427a5113b403ce214d3d8513cd740977a834f5efdbb4aac46fc83f74f54a2b925836e6860cf008226232956ee5dc975f08cd88215aa198f2
-  data.tar.gz: 2940dd71610ea52f3c18ea942f0a2fd4122028f9c1c0bce5986506501c24c5603d981406e997b662e68986411244db442747e453ff65a49431551d56d8da0eac
+  metadata.gz: be15b77c46a135d213cd6e6e6bc7000b961e036febdb8f75bb922f09554d68ab757d5094fe96816c83c5966a3094daa32ecbbee798b2a8bb72417df9506ac3b3
+  data.tar.gz: a5fec610e9193d449ef49fbfde36688398c9e4e576da5ea579165c306ecc51bc910d0d758c923a9bece59ef4e7651347f9ebb7951504f3354b101fe5f845173a

data/README.md

@@ -46,6 +46,7 @@ This gem implements the following RFCs and features of OAuth:
 
 * `oauth_dynamic_client_registration` - [Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591);
 * OAuth application and token management dashboards;
+*  The recommendations for [Native Apps](https://www.rfc-editor.org/rfc/rfc8252);
 
 It also implements the [OpenID Connect layer](https://openid.net/connect/) (via the `openid` feature) on top of the OAuth features it provides, including:
 

data/doc/release_notes/1_1_0.md

@@ -0,0 +1,9 @@
+## 1.0.0 (10/01/2023)
+
+## Features
+
+### Loopback Interface Redirection URI support
+
+https://www.rfc-editor.org/rfc/rfc8252#section-7.3
+
+Redirect URIs based on loopback addresses ("127.0.0.1", "::1") are now supported when used in an authorization request with an ephemeral port (@avdigrimm).

data/lib/rodauth/features/oauth_authorize_base.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "ipaddr"
 require "rodauth/oauth"
 
 module Rodauth
@@ -71,7 +72,8 @@ module Rodauth
       redirect_uris = oauth_application[oauth_applications_redirect_uri_column].split(" ")
 
       if (redirect_uri = param_or_nil("redirect_uri"))
-        redirect_authorize_error("redirect_uri") unless redirect_uris.include?(redirect_uri)
+        normalized_redirect_uri = normalize_redirect_uri_for_comparison(redirect_uri)
+        redirect_authorize_error("redirect_uri") unless redirect_uris.include?(normalized_redirect_uri)
       elsif redirect_uris.size > 1
         redirect_authorize_error("redirect_uri")
       end
@@ -211,5 +213,26 @@ module Rodauth
       end
       create_params[oauth_grants_code_column]
     end
+
+    def normalize_redirect_uri_for_comparison(redirect_uri)
+      uri = URI(redirect_uri)
+
+      return redirect_uri unless uri.scheme == "http" && uri.port
+
+      hostname = uri.hostname
+
+      # https://www.rfc-editor.org/rfc/rfc8252#section-7.3
+      # ignore (potentially ephemeral) port number for native clients per RFC8252
+      begin
+        ip = IPAddr.new(hostname)
+        uri.port = nil if ip.loopback?
+      rescue IPAddr::InvalidAddressError
+        # https://www.rfc-editor.org/rfc/rfc8252#section-8.3
+        # Although the use of localhost is NOT RECOMMENDED, it is still allowed.
+        uri.port = nil if hostname == "localhost"
+      end
+
+      uri.to_s
+    end
   end
 end

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.0.0"
+    VERSION = "1.1.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Tiago Cardoso
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-12-15 00:00:00.000000000 Z
+date: 2023-01-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rodauth
@@ -67,6 +67,7 @@ extra_rdoc_files:
 - doc/release_notes/0_9_2.md
 - doc/release_notes/0_9_3.md
 - doc/release_notes/1_0_0.md
+- doc/release_notes/1_1_0.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -105,6 +106,7 @@ files:
 - doc/release_notes/0_9_2.md
 - doc/release_notes/0_9_3.md
 - doc/release_notes/1_0_0.md
+- doc/release_notes/1_1_0.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb
@@ -194,7 +196,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.32
+rubygems_version: 3.3.7
 signing_key:
 specification_version: 4
 summary: Implementation of the OAuth 2.0 protocol on top of rodauth.