Authlib 1.6.9__tar.gz → 1.6.11__tar.gz

{authlib-1.6.9 → authlib-1.6.11}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.9
+Version: 1.6.11
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.9 → authlib-1.6.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.6.9
+Version: 1.6.11
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.6.9 → authlib-1.6.11}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.6.9"
+version = "1.6.11"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.6.9 → authlib-1.6.11}/authlib/integrations/starlette_client/apps.py

@@ -14,11 +14,7 @@ class StarletteAppMixin:
     async def save_authorize_data(self, request, **kwargs):
         state = kwargs.pop("state", None)
         if state:
-            if self.framework.cache:
-                session = None
-            else:
-                session = request.session
-            await self.framework.set_state_data(session, state, kwargs)
+            await self.framework.set_state_data(request.session, state, kwargs)
         else:
             raise RuntimeError("Missing state value")
 
@@ -80,13 +76,10 @@ class StarletteOAuth2App(
                     "state": form.get("state"),
                 }
 
-        if self.framework.cache:
-            session = None
-        else:
-            session = request.session
-
-        state_data = await self.framework.get_state_data(session, params.get("state"))
-        await self.framework.clear_state_data(session, params.get("state"))
+        state_data = await self.framework.get_state_data(
+            request.session, params.get("state")
+        )
+        await self.framework.clear_state_data(request.session, params.get("state"))
         params = self._format_state_params(state_data, params)
 
         claims_options = kwargs.pop("claims_options", None)

{authlib-1.6.9 → authlib-1.6.11}/authlib/integrations/starlette_client/integration.py

@@ -22,6 +22,10 @@ class StarletteIntegration(FrameworkIntegration):
     ) -> dict[str, Any]:
         key = f"_state_{self.name}_{state}"
         if self.cache:
+            # require a session-bound marker to prove the callback originates
+            # from the user-agent that started the flow (RFC 6749 §10.12)
+            if session is None or session.get(key) is None:
+                return None
             value = await self._get_cache_data(key)
         elif session is not None:
             value = session.get(key)
@@ -37,21 +41,27 @@ class StarletteIntegration(FrameworkIntegration):
     ):
         key_prefix = f"_state_{self.name}_"
         key = f"{key_prefix}{state}"
+        now = time.time()
         if self.cache:
             await self.cache.set(key, json.dumps({"data": data}), self.expires_in)
+            if session is not None:
+                # clear old state data to avoid session size growing
+                for old_key in list(session.keys()):
+                    if old_key.startswith(key_prefix):
+                        session.pop(old_key)
+                session[key] = {"exp": now + self.expires_in}
         elif session is not None:
             # clear old state data to avoid session size growing
             for old_key in list(session.keys()):
                 if old_key.startswith(key_prefix):
                     session.pop(old_key)
-            now = time.time()
             session[key] = {"data": data, "exp": now + self.expires_in}
 
     async def clear_state_data(self, session: Optional[dict[str, Any]], state: str):
         key = f"_state_{self.name}_{state}"
         if self.cache:
             await self.cache.delete(key)
-        elif session is not None:
+        if session is not None:
             session.pop(key, None)
             self._clear_session_state(session)
 

{authlib-1.6.9 → authlib-1.6.11}/authlib/oauth2/rfc6749/authorization_server.py

@@ -241,10 +241,21 @@ class AuthorizationServer(Hookable):
             if grant_cls.check_authorization_endpoint(request):
                 return _create_grant(grant_cls, extensions, request, self)
 
+        # Per RFC 6749 §4.1.2.1, only redirect with the error if the client
+        # exists and the redirect_uri has been validated against it.
+        redirect_uri = None
+        if client_id := request.payload.client_id:
+            if client := self.query_client(client_id):
+                if requested_uri := request.payload.redirect_uri:
+                    if client.check_redirect_uri(requested_uri):
+                        redirect_uri = requested_uri
+                else:
+                    redirect_uri = client.get_default_redirect_uri()
+
         raise UnsupportedResponseTypeError(
             f"The response type '{request.payload.response_type}' is not supported by the server.",
             request.payload.response_type,
-            redirect_uri=request.payload.redirect_uri,
+            redirect_uri=redirect_uri,
         )
 
     def get_consent_grant(self, request=None, end_user=None):