fastapi-sso 0.18.0__py3-none-any.whl → 0.19.0__py3-none-any.whl

fastapi_sso/sso/base.py

@@ -341,6 +341,8 @@ class SSOBase:
         response = RedirectResponse(login_uri, 303)
         if self.uses_pkce:
             response.set_cookie("pkce_code_verifier", str(self._pkce_code_verifier))
+        if state is not None:
+            response.set_cookie("sso_state", state)
         return response
 
     @overload
@@ -402,6 +404,14 @@ class SSOBase:
             )
             raise SSOLoginError(400, "'code' parameter was not found in callback request")
         self._state = request.query_params.get("state")
+        if self._state is None and self.requires_state:
+            raise SSOLoginError(400, "'state' parameter was not found in callback request")
+        if self._state is not None:
+            sso_state = request.cookies.get("sso_state")
+            if sso_state is None and self.requires_state:
+                raise SSOLoginError(401, "State cookie not found")
+            if sso_state is not None and sso_state != self._state:
+                raise SSOLoginError(401, "Invalid state")
         pkce_code_verifier: Optional[str] = None
         if self.uses_pkce:
             pkce_code_verifier = request.cookies.get("pkce_code_verifier")

{fastapi_sso-0.18.0.dist-info → fastapi_sso-0.19.0.dist-info}/METADATA

@@ -1,8 +1,9 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: fastapi-sso
-Version: 0.18.0
+Version: 0.19.0
 Summary: FastAPI plugin to enable SSO to most common providers (such as Facebook login, Google login and login via Microsoft Office 365 Account)
 License: MIT
+License-File: LICENSE.md
 Keywords: fastapi,sso,oauth,google,facebook,spotify,linkedin
 Author: Tomas Votava
 Author-email: info@tomasvotava.eu
@@ -14,6 +15,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Requires-Dist: fastapi (>=0.80)
 Requires-Dist: httpx (>=0.23.0)
 Requires-Dist: oauthlib (>=3.1.0)
@@ -73,6 +75,16 @@ by [@parikls](https://github.com/parikls).
 This issue was reported in [#186](https://github.com/tomasvotava/fastapi-sso/issues/186) and has been resolved
 in version `0.16.0`.
 
+### Version `0.19.0` Update: OAuth `state` Validation Fix
+
+A critical OAuth login CSRF vulnerability caused by missing `state` validation was
+reported by [@davidbors-snyk](https://github.com/davidbors-snyk) (Snyk Security Labs)
+in [#266](https://github.com/tomasvotava/fastapi-sso/issues/266) and has been resolved
+in version `0.19.0`.
+
+Starting with `fastapi-sso==1.0.0`, OAuth `state` will be backed by a pluggable server-side store
+(in-memory by default, with support for external stores such as `Redis`).
+
 **Details of the Fix:**
 
 The bug was mitigated by introducing an async lock mechanism that ensures only one user can attempt the login

{fastapi_sso-0.18.0.dist-info → fastapi_sso-0.19.0.dist-info}/RECORD

@@ -2,7 +2,7 @@ fastapi_sso/__init__.py,sha256=2xdjBYKS18YTwHRsOCTibfL9xRxBZLVe03waEiMVNhg,1120
 fastapi_sso/pkce.py,sha256=DhxoJrBIUxDlhAmy5tAoSIBts1WsyQ5KGqLbvDQER1w,767
 fastapi_sso/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 fastapi_sso/sso/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-fastapi_sso/sso/base.py,sha256=s3SBUfjZcP17sIhVLK8pV1BK65zjt18nlC_g36FmGLw,22676
+fastapi_sso/sso/base.py,sha256=juAQMbXJ19-EnbtkWP2bIBhRUrX6vbzdV_eKBicMh0o,23249
 fastapi_sso/sso/bitbucket.py,sha256=pqMBDNhVR5rqda3yq5HCXsJzBFZBH2Df6SMIve6btYY,2109
 fastapi_sso/sso/discord.py,sha256=iJzR17XyPq8YJWwht083yPyCrEtLOHD3E1HGxDSgUtQ,1786
 fastapi_sso/sso/facebook.py,sha256=JaGCT2v56iRRQlnoZ5OSsB19677gyMU7U5dZTjVE_mc,1368
@@ -22,7 +22,7 @@ fastapi_sso/sso/spotify.py,sha256=FvX2N91Bi3wgKRwdU1sWo-zA0s3wYJCiCYA05ebXweE,12
 fastapi_sso/sso/twitter.py,sha256=1kMjFdh-OT1b5bJvY3tWfl-BRBv2hVZ6L_liLAvNML8,1249
 fastapi_sso/sso/yandex.py,sha256=8jKkh-na62lwsaBW7Pvj6VC6WlR0RMg8KrSNlr2Hj8o,1507
 fastapi_sso/state.py,sha256=9RKMrFGjeN4Ab-3var81QV-gpcBlnNy152WYbxTUGVY,300
-fastapi_sso-0.18.0.dist-info/LICENSE.md,sha256=5NVQtYs6liDtYdWM4VObWmTTKaK0k9C9txx5pLPJSyQ,1093
-fastapi_sso-0.18.0.dist-info/METADATA,sha256=5E3Hn1f4FDZOHR5rRAJQ37o6Uevv3G9G97ae1FOLLKo,7185
-fastapi_sso-0.18.0.dist-info/WHEEL,sha256=XbeZDeTWKc1w7CSIyre5aMDU_-PohRwTQceYnisIYYY,88
-fastapi_sso-0.18.0.dist-info/RECORD,,
+fastapi_sso-0.19.0.dist-info/METADATA,sha256=epJN5NOtoDaKbSvX29GCY3OF71tFb4VXUcJeDA5kz0E,7771
+fastapi_sso-0.19.0.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
+fastapi_sso-0.19.0.dist-info/licenses/LICENSE.md,sha256=5NVQtYs6liDtYdWM4VObWmTTKaK0k9C9txx5pLPJSyQ,1093
+fastapi_sso-0.19.0.dist-info/RECORD,,

{fastapi_sso-0.18.0.dist-info → fastapi_sso-0.19.0.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: poetry-core 2.1.1
+Generator: poetry-core 2.2.1
 Root-Is-Purelib: true
 Tag: py3-none-any