Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

What about handling rfc6749 Error Response? #219

Open
Cellard opened this issue Aug 11, 2023 · 1 comment
Open

What about handling rfc6749 Error Response? #219

Cellard opened this issue Aug 11, 2023 · 1 comment
Labels

Comments

@Cellard
Copy link

Cellard commented Aug 11, 2023

Issue / Motivation:

While requesting for authorization using any of response_type methods server may responds (redirect back) with error.

For response_type=code see https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1
For response_type=token see https://datatracker.ietf.org/doc/html/rfc6749#section-4.2.2.1

Also, then requesting for access_token with any grant_type server may respond with an error. See https://datatracker.ietf.org/doc/html/rfc6749#section-5.2

Expected behaviour:

Socialite Manager should examine callback request and throw an exception with error and its description (just like InvalidStateException does).

Socialite Manager should examine token response and throw an exception with error and its description.

Actual behavior:

Socialite Manager tries to exchange code to access_token although code is missing in request. So it got an unsurprising error response.

Socialite Manager tries to parse access_token form token response even access_token is missing. Then it makes request to Resource Owner with empty string in Authorisation header.

Steps to reproduce the behavior:

Try to authorize to any (rfc6749 compliant) server with response_type=foobar and you will get unsupported_response_type error.

Or request for scope=foobar (that is not supported by the server). You will get invalid_scope error in response.

Proposed solution:

Im ready to make a pr. If you resolve this issue has sense.

@stale
Copy link

stale bot commented Oct 15, 2023

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the stale label Oct 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant