fix: validate requested scope on authorize request by razvanz · Pull Request #451 · oauthjs/node-oauth2-server

razvanz · 2017-10-23T09:14:32Z

Without validating the scope of a authorize request, a client could get access to unauthorized scopes.

steffansluis · 2017-12-12T18:16:12Z

What is the status on this?

razvanz · 2017-12-12T19:13:17Z

@steffansluis If you're addressing to me, I'm still waiting for someone to have a look.

steffansluis · 2017-12-12T19:49:44Z

@razvanz Actually it was more like a broadcast message to the maintainers of this repo. @mjsalinger you seem to be the most recently active. Any insights into a timeline for this PR/in general for maintaining this repo?

mjsalinger · 2018-01-24T12:41:58Z

        });
    });

+    it('should redirect to an error response if `scope` is insufficient', function() {


Can you add a test for when validateScope isn't included in the model? Otherwise this PR looks good.

razvanz · 2018-01-29T12:44:28Z

Added the test and rebased from dev branch.

mjsalinger

LGTM

…horize fix: validate requested scope on authorize request

fix: validate requested scope on authorize request

* Compute the correct redirect_uri in case of resource over denies access According to https://tools.ietf.org/html/rfc6749#section-4.1.2.1 once the redirect_uri & client_id is correct authorization server should inform the clinet, that user denied access. The change is to move validation of resource owner approval after the redirect_uri & client identifier validation so the correct redirect url is computed * Remove commented code * Note we're now also seeking reviewers * Update readme with link to v5-dev branch * Add renovate.json * Add link to examples repo. Closes oauthjs#571 * Update dependency bluebird to v3.7.2 * Update dependency jshint to v2.11.0 * Update dependency mocha to v3.5.3 * Update dependency sinon to v2.4.1 * Update dependency statuses to v1.5.0 * Update dependency basic-auth to v2 * Update node versions * Bump lodash from 4.17.4 to 4.17.15 Bumps [lodash](https://github.com/lodash/lodash) from 4.17.4 to 4.17.15. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.4...4.17.15) Signed-off-by: dependabot[bot] <support@github.com> * Update dependency type-is to v1.6.18 * Update dependency should to v13 * add codecoverage and upgrade packages * Update dependency jshint to v2.11.1 * Drop support for node 4/6/8 and add tests for 14 * Update dependency sinon to v9 * Update dependency mocha to v7 * Release 3.0.2 🎉 * Release 3.0.2 🎉 * Revert "Drop support for node 4/6/8 and add tests for 14" This reverts commit b84778b. * Revert "Merge pull request oauthjs#596 from oauthjs/renovate/mocha-7.x" This reverts commit cb2bb88, reversing changes made to 6997303. * Revert "Merge pull request oauthjs#602 from oauthjs/renovate/sinon-9.x" This reverts commit 6997303, reversing changes made to b84778b. * Bump mocha and sinon to lastest versions supporting node v4 * Add testing for node v14 * Update readme with project status update * remove renovate in favour of dependabot * Add FUNDING.yml (oauthjs#630) * Updated .gitignore * Changed 'hasOwnProperty' call in Request * Changed 'hasOwnProperty' call in Response * set numArgs for promisify of generateAuthorizationCode * readme: Update Slack badge and link * fix: issue correct expiry dates for tokens oauthjs#444 related to a NodeJS (nodejs/node#7074) and furthermore V8 bug (https://bugs.chromium.org/p/v8/issues/detail?id=3637); replaced seconds calculation with milliseconds. * Merge pull request oauthjs#451 from razvanz/fix/validate-scope-on-authorize fix: validate requested scope on authorize request * Merge pull request oauthjs#491 from mattgrande/master docs: Ensure accessTokenExpiresAt is required * Merge pull request oauthjs#471 from smartrecruiters/fix-migration-documentaiton docs: Correct tokens time scale for 2.x to 3.x migration guide * Updated changelog * Tag 3.1.0-rc1 * 3.1.0 bump * Bump lodash from 4.17.15 to 4.17.19 Bumps [lodash](https://github.com/lodash/lodash) from 4.17.15 to 4.17.19. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.15...4.17.19) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> * v3.1.1 (oauthjs#636) * Bump jshint from 2.11.1 to 2.12.0 (oauthjs#640) Bumps [jshint](https://github.com/jshint/jshint) from 2.11.1 to 2.12.0. - [Release notes](https://github.com/jshint/jshint/releases) - [Changelog](https://github.com/jshint/jshint/blob/master/CHANGELOG.md) - [Commits](jshint/jshint@2.11.1...2.12.0) Signed-off-by: dependabot-preview[bot] <support@dependabot.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com> * Set WWW-Authenticate header for invalid requests This adds the WWW-Authenticate header for InvalidRequestError, InvalidTokenError, and InsufficientScopeError, as specified in RFC 6750, Section 3 Fixes oauthjs#553 * cherry pick * rm lock * fix: lint erros * fix grant types * custom types init * Update .travis.yml * git merge artifact Co-authored-by: Igor Czechowski <i.czechowski@smartrecruiters.com> Co-authored-by: Szymon Kiebzak <s.kiebzak@smartrecruiters.com> Co-authored-by: Thom Seddon <thom@seddonmedia.co.uk> Co-authored-by: Renovate Bot <bot@renovateapp.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Aras Abbasi <aras.abbasi@googlemail.com> Co-authored-by: mjsalinger <mjsalinger@gmail.com> Co-authored-by: Pritilender <sajn_ap@live.com> Co-authored-by: nkzawa <naoyuki.kanezawa@gmail.com> Co-authored-by: Max Truxa <dev@maxtruxa.com> Co-authored-by: Razvan <razvanz@users.noreply.github.com> Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com> Co-authored-by: Jonas Hermsmeier <jonas.hermsmeier@klarna.com>

maxtruxa added needs review v3 labels Oct 24, 2017

mjsalinger suggested changes Jan 24, 2018

View reviewed changes

razvanz and others added 2 commits January 29, 2018 13:43

fix: validate requested scope on authorize request (#3)

23214dc

code review

641599f

razvanz force-pushed the fix/validate-scope-on-authorize branch from 78edd5c to 641599f Compare January 29, 2018 12:44

mjsalinger approved these changes Feb 13, 2018

View reviewed changes

mjsalinger merged commit 9d721a3 into oauthjs:dev Feb 13, 2018

mjsalinger added a commit to mjsalinger/node-oauth2-server that referenced this pull request Aug 27, 2018

Merge pull request oauthjs#451 from razvanz/fix/validate-scope-on-aut…

c31841f

…horize fix: validate requested scope on authorize request

thomseddon pushed a commit that referenced this pull request Jun 11, 2020

Merge pull request #451 from razvanz/fix/validate-scope-on-authorize

a94ab36

fix: validate requested scope on authorize request

thomseddon pushed a commit that referenced this pull request Jun 11, 2020

Merge pull request #451 from razvanz/fix/validate-scope-on-authorize

5733877

fix: validate requested scope on authorize request

This was referenced Jun 26, 2020

V3.1 catchup #629

Merged

Remove validateScope check from auth_code grant type #631

Open

thomseddon pushed a commit that referenced this pull request Jun 27, 2020

Merge pull request #451 from razvanz/fix/validate-scope-on-authorize

75515d5

fix: validate requested scope on authorize request

thomseddon pushed a commit that referenced this pull request Jun 27, 2020

Merge pull request #451 from razvanz/fix/validate-scope-on-authorize

b3fe4d5

fix: validate requested scope on authorize request

thomseddon pushed a commit that referenced this pull request Jun 30, 2020

Merge pull request #451 from razvanz/fix/validate-scope-on-authorize

e3f8e18

fix: validate requested scope on authorize request

joe1chen pushed a commit to dogomedia/node-oauth2-server that referenced this pull request Oct 8, 2020

Port handler tests in pull oauthjs#451 from dev branch.

a7a6a0a

This was referenced Mar 17, 2021

chore(deps-dev): bump oauth2-server from 2.4.1 to 3.1.1 atxwebs/swagger-ui#508

Open

chore(deps-dev): bump oauth2-server from 2.4.1 to 3.1.1 hkosova/swagger-ui#6

Closed

Navigation Menu

Uh oh!

Uh oh!

fix: validate requested scope on authorize request - #451

fix: validate requested scope on authorize request#451
mjsalinger merged 2 commits into
oauthjs:devfrom
razvanz:fix/validate-scope-on-authorize

razvanz commented Oct 23, 2017 •

edited

Loading

Uh oh!

steffansluis commented Dec 12, 2017

Uh oh!

razvanz commented Dec 12, 2017

Uh oh!

steffansluis commented Dec 12, 2017

Uh oh!

mjsalinger Jan 24, 2018

Uh oh!

razvanz commented Jan 29, 2018

Uh oh!

mjsalinger left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Uh oh!

Conversation

razvanz commented Oct 23, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steffansluis commented Dec 12, 2017

Uh oh!

razvanz commented Dec 12, 2017

Uh oh!

steffansluis commented Dec 12, 2017

Uh oh!

mjsalinger Jan 24, 2018

Choose a reason for hiding this comment

Uh oh!

razvanz commented Jan 29, 2018

Uh oh!

mjsalinger left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

razvanz commented Oct 23, 2017 •

edited

Loading