AIUS/Overleaf
1
0
Fork 0
mirror of https://git.unistra.fr/aius/root/ldap-overleaf-sl.git synced 2024-10-05 23:23:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add OAuth2 state validation

Browse Source
This commit is contained in:
yzx9 2023-11-25 01:26:00 +08:00
parent d94aa2fdf9
commit 40eb01cce4
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ldap-overleaf-sl/sharelatex/AuthenticationController.js
View File

@ -274,18 +274,31 @@ const AuthenticationController = {
// >>>>>>>>>>>>>>>>>>>>>>>>>>>>>> // >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
oauth2Redirect(req, res, next) { oauth2Redirect(req, res, next) {
// random state
const characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
const state = new Array(6).fill(0).map(() => characters.charAt(Math.floor(Math.random() * characters.length))).join("")
req.session.oauth2State = state
const redirectURI = encodeURIComponent(`${process.env.SHARELATEX_SITE_URL}/oauth/callback`) const redirectURI = encodeURIComponent(`${process.env.SHARELATEX_SITE_URL}/oauth/callback`)
const authURL = ( const authURL = (
process.env.OAUTH2_AUTHORIZATION_URL process.env.OAUTH2_AUTHORIZATION_URL
+ `?response_type=code` + `?response_type=code`
+ `&client_id=${process.env.OAUTH2_CLIENT_ID}` + `&client_id=${process.env.OAUTH2_CLIENT_ID}`
+ `&redirect_uri=${redirectURI}` + `&redirect_uri=${redirectURI}`
+ `&scope=${process.env.OAUTH2_SCOPE ?? ""}` // TODO: state + `&scope=${process.env.OAUTH2_SCOPE ?? ""} `
+ `&state=${state}`
) )
res.redirect(authURL) res.redirect(authURL)
}, },
async oauth2Callback(req, res, next) { async oauth2Callback(req, res, next) {
const saveState = req.session.oauth2State
delete req.session.oauth2State
if (saveState !== req.query.state) {
console.log("OAuth ", JSON.stringify(user))
return AuthenticationController.finishLogin(false, req, res, next)
}
try { try {
console.log("OAuth2 code", req.query.code) console.log("OAuth2 code", req.query.code)
const tokenResponse = await fetch(process.env.OAUTH2_TOKEN_URL, { const tokenResponse = await fetch(process.env.OAUTH2_TOKEN_URL, {