Authlib 1.9.2__tar.gz → 1.9.3__tar.gz

{authlib-1.9.2 → authlib-1.9.3}/Authlib.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.9.2
+Version: 1.9.3
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.9.2 → authlib-1.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: Authlib
-Version: 1.9.2
+Version: 1.9.3
 Summary: The ultimate Python library in building OAuth and OpenID Connect servers and clients.
 Author-email: Hsiaoming Yang <me@lepture.com>
 License: BSD-3-Clause

{authlib-1.9.2 → authlib-1.9.3}/authlib/consts.py

@@ -1,5 +1,5 @@
 name = "Authlib"
-version = "1.9.2"
+version = "1.9.3"
 author = "Hsiaoming Yang <me@lepture.com>"
 homepage = "https://authlib.org"
 default_user_agent = f"{name}/{version} (+{homepage})"

{authlib-1.9.2 → authlib-1.9.3}/authlib/oidc/core/grants/hybrid.py

@@ -8,6 +8,7 @@ from authlib.oauth2.rfc6749.grants.authorization_code import (
 
 from .implicit import OpenIDImplicitGrant
 from .util import is_openid_scope
+from .util import validate_form_post_redirect_uri
 from .util import validate_nonce
 
 log = logging.getLogger(__name__)
@@ -56,6 +57,7 @@ class OpenIDHybridGrant(OpenIDImplicitGrant):
             ),
         )
         redirect_uri = validate_code_authorization_request(self)
+        validate_form_post_redirect_uri(self, redirect_uri)
         if not is_openid_scope(self.request.scope):
             raise InvalidScopeError(
                 "Missing 'openid' scope",

{authlib-1.9.2 → authlib-1.9.3}/authlib/oidc/core/grants/implicit.py

@@ -15,6 +15,7 @@ from ._legacy import LegacyMixin
 from .util import create_half_hash
 from .util import create_response_mode_response
 from .util import is_openid_scope
+from .util import validate_form_post_redirect_uri
 from .util import validate_nonce
 from .util import validate_request_prompt
 
@@ -69,6 +70,7 @@ class OpenIDImplicitGrant(LegacyMixin, ImplicitGrant):
 
     def validate_authorization_request(self):
         redirect_uri = super().validate_authorization_request()
+        validate_form_post_redirect_uri(self, redirect_uri)
         if not is_openid_scope(self.request.scope):
             raise InvalidScopeError(
                 "Missing 'openid' scope",

{authlib-1.9.2 → authlib-1.9.3}/authlib/oidc/core/grants/util.py

@@ -6,6 +6,7 @@ from authlib._joserfc_helpers import import_any_key
 from authlib.common.encoding import to_native
 from authlib.common.urls import add_params_to_uri
 from authlib.common.urls import quote_url
+from authlib.common.urls import urlparse
 from authlib.oauth2.rfc6749 import InvalidRequestError
 from authlib.oauth2.rfc6749 import scope_to_list
 
@@ -51,6 +52,28 @@ def validate_request_prompt(grant, redirect_uri, redirect_fragment=False):
     return grant
 
 
+def validate_form_post_redirect_uri(grant, redirect_uri):
+    """Reject the ``form_post`` response mode for a non-HTTP redirect URI.
+
+    With ``form_post``, the user-agent submits an HTML form to the redirect
+    URI. A ``javascript:`` redirect URI would then run a script in the
+    origin of the authorization server.
+
+    :param grant: the grant that validates the authorization request
+    :param redirect_uri: the redirect URI of the authorization request
+    :raises InvalidRequestError: if the redirect URI scheme is not http or https
+    """
+    response_mode = grant.request.payload.data.get(
+        "response_mode", grant.DEFAULT_RESPONSE_MODE
+    )
+    if response_mode != "form_post":
+        return
+    if urlparse.urlparse(redirect_uri).scheme not in ("http", "https"):
+        raise InvalidRequestError(
+            "The 'form_post' response mode requires an http or https redirect URI."
+        )
+
+
 def validate_nonce(request, exists_nonce, required=False):
     nonce = request.payload.data.get("nonce")
     if not nonce: