kubeagent 0.1.8 → 0.1.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth.js +21 -14
- package/package.json +1 -1
package/dist/auth.js
CHANGED
|
@@ -53,13 +53,19 @@ export async function loginBrowser(serverUrl, appUrl) {
|
|
|
53
53
|
res.end();
|
|
54
54
|
return;
|
|
55
55
|
}
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
const
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
56
|
+
// Parse credentials from POST body (hidden form submit) to avoid
|
|
57
|
+
// leaking the JWT in URL query params, browser history, and Referer headers.
|
|
58
|
+
const chunks = [];
|
|
59
|
+
req.on("data", (chunk) => chunks.push(chunk));
|
|
60
|
+
req.on("end", () => {
|
|
61
|
+
const body = Buffer.concat(chunks).toString();
|
|
62
|
+
const params = new URLSearchParams(body);
|
|
63
|
+
const receivedState = params.get("state");
|
|
64
|
+
const token = params.get("token");
|
|
65
|
+
const email = params.get("email") ?? "";
|
|
66
|
+
const name = params.get("name") ?? "";
|
|
67
|
+
res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
|
|
68
|
+
res.end(`<!DOCTYPE html>
|
|
63
69
|
<html lang="en">
|
|
64
70
|
<head>
|
|
65
71
|
<meta charset="UTF-8" />
|
|
@@ -89,13 +95,14 @@ export async function loginBrowser(serverUrl, appUrl) {
|
|
|
89
95
|
</div>
|
|
90
96
|
</body>
|
|
91
97
|
</html>`);
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
98
|
+
server.close();
|
|
99
|
+
if (receivedState !== state || !token) {
|
|
100
|
+
reject(new Error("Invalid callback — state mismatch or missing token"));
|
|
101
|
+
}
|
|
102
|
+
else {
|
|
103
|
+
resolve({ token, email, name });
|
|
104
|
+
}
|
|
105
|
+
});
|
|
99
106
|
});
|
|
100
107
|
server.listen(0, "127.0.0.1", async () => {
|
|
101
108
|
const port = server.address().port;
|