girder-oauth 3.2.4.dev37__tar.gz → 3.2.5.dev3__tar.gz

{girder_oauth-3.2.4.dev37 → girder_oauth-3.2.5.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: girder-oauth
-Version: 3.2.4.dev37
+Version: 3.2.5.dev3
 Summary: Allow users to login via supported OAuth2 providers.
 Home-page: http://girder.readthedocs.io/en/latest/plugins.html#oauth-login
 Author: Kitware, Inc.

{girder_oauth-3.2.4.dev37 → girder_oauth-3.2.5.dev3}/girder_oauth/rest.py

@@ -135,12 +135,13 @@ class OAuth(Resource):
         if event.defaultPrevented:
             raise cherrypy.HTTPRedirect(redirect)
 
-        token = str(Token().createToken(user)['_id'])
+        token = Token().createToken(user)
+        token_id = str(token['_id'])
 
         # Set `girderToken` in the query params of the redirect URL
         parsed = urlparse(redirect)
         query_params = parse_qs(parsed.query)
-        query_params['girderToken'] = token
+        query_params['girderToken'] = token_id
         encoded_query_params = urlencode(query_params)
         updated_redirect = urlunparse((
             parsed.scheme,
@@ -151,4 +152,8 @@ class OAuth(Resource):
             parsed.fragment,
         ))
 
+        # The cookie is still used for e.g. file downloads. Send it from the server
+        # to support HttpOnly usage.
+        self.sendAuthTokenCookie(token=token)
+
         raise cherrypy.HTTPRedirect(updated_redirect)

{girder_oauth-3.2.4.dev37 → girder_oauth-3.2.5.dev3}/girder_oauth.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: girder-oauth
-Version: 3.2.4.dev37
+Version: 3.2.5.dev3
 Summary: Allow users to login via supported OAuth2 providers.
 Home-page: http://girder.readthedocs.io/en/latest/plugins.html#oauth-login
 Author: Kitware, Inc.

{girder_oauth-3.2.4.dev37 → girder_oauth-3.2.5.dev3}/plugin_tests/oauth_test.py

@@ -309,6 +309,7 @@ class OauthTest(base.TestCase):
             self.assertStatus(resp, 303)
             expr = re.compile(r'^http://localhost/\?girderToken=(\w+)#foo/bar$')
             self.assertRegex(resp.headers['Location'], expr)
+            self.assertTrue('girderToken' in resp.cookie)
 
             girderToken = expr.match(resp.headers['Location']).group(1)
             resp = self.request('/user/me', token=girderToken)