Comments (4)
scruoge
commented on June 5, 2024
1
my bad. base64-url !== base64.
I think the issue can be closed
from oauth2-server.
Sephster
commented on June 5, 2024
I've had a very quick look at this (in work) and I can see we have a verifier for an S256 code challenge. Is this not being used? Are you able to link to some code? I can have a look at this this evening but any assistance you can give in pointing to the issue in the code would be greatly appreciated. Thank you
from oauth2-server.
scruoge
commented on June 5, 2024
oauth2-server/src/Grant/AuthCodeGrant.php
Lines 328 to 335 in 0576f39
This validation applies for both S256 and plain code_challenge_method, while different methods are processing code_challenge string differently (according to RFC I've quoted above), I'm getting problem when passing code_challenge='lokeXcw5iV7Y3CGiaOdzsX0KQ15dk9P5MCs8Bb3ZphE=', which is
$codeVerifier = base64_encode(random_bytes(32));
$codeChallenge = base64_encode(hash(algo: 'sha256', data: $codeVerifier, binary: true));
from oauth2-server.
scruoge
commented on June 5, 2024
closed
from oauth2-server.
Related Issues (20)
- Configuring client_id and client_secret HOT 2
- Custom unique identifier generator
- Bump league/uri to ^7.0 (psr/http-message:^2.0 related) HOT 4
- Documentation: AuthCode grant redirect_uri must match authorization request
- RefreshTokenGrant requires client_secret also for non-confidential clients HOT 3
- how to validate client when exchanging auth code for access token HOT 1
- Class "League\Uri\UriString" not found HOT 8
- Reuse or revoke existing or access and refresh tokens on new auth HOT 10
- Google warning - Deceptive site ahead HOT 8
- Implict grant for OIDC not supported HOT 1
- Why setUserIdentifier, not setUser? HOT 9
- Test Refresh Token Fails on Google Home Test Suite HOT 2
- Possibility of using different encryptor for shortening auth code HOT 2
- Does anyone know if this library is vulnerable to this hack? HOT 1
- Support league/event v3 HOT 4
- League/Oauth2-Server Key Exposure In Exception Message HOT 2
- AccessTokenTrait::__toString gives different result each call HOT 1
- Wrong Type in DocBlock 3rd param `AbstractGrant::issueAccessToken` HOT 1
- 2FA HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from oauth2-server.