Authlib 1.6.10__tar.gz → 1.6.12__tar.gz

{authlib-1.6.10 → authlib-1.6.12}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.10
+Version: 1.6.12
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.10 → authlib-1.6.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.10
+Version: 1.6.12
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.10 → authlib-1.6.12}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.6.10"
+version = "1.6.12"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.6.10 → authlib-1.6.12}/authlib/integrations/starlette_client/apps.py

@@ -14,11 +14,7 @@ class StarletteAppMixin:
     async def save_authorize_data(self, request, **kwargs):
         state = kwargs.pop("state", None)
         if state:
-            if self.framework.cache:
-                session = None
-            else:
-                session = request.session
-            await self.framework.set_state_data(session, state, kwargs)
+            await self.framework.set_state_data(request.session, state, kwargs)
         else:
             raise RuntimeError("Missing state value")
 
@@ -80,13 +76,10 @@ class StarletteOAuth2App(
                     "state": form.get("state"),
                 }
 
-        if self.framework.cache:
-            session = None
-        else:
-            session = request.session
-
-        state_data = await self.framework.get_state_data(session, params.get("state"))
-        await self.framework.clear_state_data(session, params.get("state"))
+        state_data = await self.framework.get_state_data(
+            request.session, params.get("state")
+        )
+        await self.framework.clear_state_data(request.session, params.get("state"))
         params = self._format_state_params(state_data, params)
 
         claims_options = kwargs.pop("claims_options", None)

{authlib-1.6.10 → authlib-1.6.12}/authlib/integrations/starlette_client/integration.py

@@ -22,6 +22,10 @@ class StarletteIntegration(FrameworkIntegration):
     ) -> dict[str, Any]:
         key = f"_state_{self.name}_{state}"
         if self.cache:
+            # require a session-bound marker to prove the callback originates
+            # from the user-agent that started the flow (RFC 6749 §10.12)
+            if session is None or session.get(key) is None:
+                return None
             value = await self._get_cache_data(key)
         elif session is not None:
             value = session.get(key)
@@ -37,21 +41,27 @@ class StarletteIntegration(FrameworkIntegration):
     ):
         key_prefix = f"_state_{self.name}_"
         key = f"{key_prefix}{state}"
+        now = time.time()
         if self.cache:
             await self.cache.set(key, json.dumps({"data": data}), self.expires_in)
+            if session is not None:
+                # clear old state data to avoid session size growing
+                for old_key in list(session.keys()):
+                    if old_key.startswith(key_prefix):
+                        session.pop(old_key)
+                session[key] = {"exp": now + self.expires_in}
         elif session is not None:
             # clear old state data to avoid session size growing
             for old_key in list(session.keys()):
                 if old_key.startswith(key_prefix):
                     session.pop(old_key)
-            now = time.time()
             session[key] = {"data": data, "exp": now + self.expires_in}
 
     async def clear_state_data(self, session: Optional[dict[str, Any]], state: str):
         key = f"_state_{self.name}_{state}"
         if self.cache:
             await self.cache.delete(key)
-        elif session is not None:
+        if session is not None:
             session.pop(key, None)
             self._clear_session_state(session)
 

{authlib-1.6.10 → authlib-1.6.12}/authlib/oidc/core/grants/hybrid.py

@@ -49,19 +49,20 @@ class OpenIDHybridGrant(OpenIDImplicitGrant):
         raise NotImplementedError()
 
     def validate_authorization_request(self):
-        if not is_openid_scope(self.request.payload.scope):
-            raise InvalidScopeError(
-                "Missing 'openid' scope",
-                redirect_uri=self.request.payload.redirect_uri,
-                redirect_fragment=True,
-            )
         self.register_hook(
             "after_validate_authorization_request_payload",
             lambda grant, redirect_uri: validate_nonce(
                 grant.request, grant.exists_nonce, required=True
             ),
         )
-        return validate_code_authorization_request(self)
+        redirect_uri = validate_code_authorization_request(self)
+        if not is_openid_scope(self.request.payload.scope):
+            raise InvalidScopeError(
+                "Missing 'openid' scope",
+                redirect_uri=redirect_uri,
+                redirect_fragment=True,
+            )
+        return redirect_uri
 
     def create_granted_params(self, grant_user):
         self.request.user = grant_user

{authlib-1.6.10 → authlib-1.6.12}/authlib/oidc/core/grants/implicit.py

@@ -82,13 +82,13 @@ class OpenIDImplicitGrant(ImplicitGrant):
         return [client.get_client_id()]
 
     def validate_authorization_request(self):
+        redirect_uri = super().validate_authorization_request()
         if not is_openid_scope(self.request.payload.scope):
             raise InvalidScopeError(
                 "Missing 'openid' scope",
-                redirect_uri=self.request.payload.redirect_uri,
+                redirect_uri=redirect_uri,
                 redirect_fragment=True,
             )
-        redirect_uri = super().validate_authorization_request()
         try:
             validate_nonce(self.request, self.exists_nonce, required=True)
         except OAuth2Error as error: