Initial OAuth2.0/PKCE Provider support #617
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fix grant_types_supported which must include "implicit" even if it is not a grant_type in oauthlib sense. Removed internal "none" field value from the list of response_types.
23 tasks
Preconf server metadata
|
@JonathanHuot it was pretty easy to implement your changes into django-oauth-toolkit. The PR containing the implementation is at jazzband/django-oauth-toolkit#678 |
|
Thanks @Maronato for your feedback! It's integrated into master now, we'll be able to release 3.0.0 soon. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Initial implementation of PKCE support for OAuth2.0 provider in oauthlib.
In order to have PKCE for your OAuth2.0 provider, you have three new RequestValidator methods to implement:
is_pkce_required(client_id, request)=> defaultreturn Falseget_code_challenge(code, request)=> defaultreturn Noneget_code_challenge_method(code, request)=> raiseNotImplemented(called only ifget_code_challengeis overriden)The behavior choosen was to not break any existing implementation, i.e. any upgrade to latest oauthlib will not give you PKCE for free and not break existing clients requests (even if they send a verifier or a challenge).
Any comments from downstream libraries devs are greatly appreciated. Also it can help jazzband/django-oauth-toolkit#656 to be resolved. Poke @jleclanche, @Maronato.