From 89cf685d0299744fe3be6d7c0fa8429b945a4d67 Mon Sep 17 00:00:00 2001 From: Braedon Vickers Date: Tue, 21 Jan 2020 19:45:29 +0800 Subject: [PATCH] Rework client authentication in SkeletonValidator for clarity SkeletonValidator was seemingly written to not support public clients at all. Its authenticate_client_id() explicitly returned `False`, rather than `pass`-ing like the other methods, and client_authentication_required() was missing entirely (the default implementation always returns `True`). This opinionated approach is confusing, especially when writing an implementation that allows public clients. The comment on the authenticate_client_id() method is particularly confusing. Unlike the comments on other methods, which explain the method, it explains the implementation (returning `False`). As a result, it appears to say the method should return `False` for public clients, when it should actually return `False` for confidential clients (and `True` for valid public clients). To reduce this confusion, include a client_authentication_required() stub, `pass` rather than returning `False` in authenticate_client_id(), and update its comment to describe the method. --- examples/skeleton_oauth2_web_application_server.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/examples/skeleton_oauth2_web_application_server.py b/examples/skeleton_oauth2_web_application_server.py index 9a303735..91859fc3 100644 --- a/examples/skeleton_oauth2_web_application_server.py +++ b/examples/skeleton_oauth2_web_application_server.py @@ -54,13 +54,18 @@ def save_authorization_code(self, client_id, code, request, *args, **kwargs): # Token request + def client_authentication_required(self, request, *args, **kwargs): + # Check if the client provided authentication information that needs to + # be validated, e.g. HTTP Basic auth + pass + def authenticate_client(self, request, *args, **kwargs): # Whichever authentication method suits you, HTTP Basic might work pass def authenticate_client_id(self, client_id, request, *args, **kwargs): - # Don't allow public (non-authenticated) clients - return False + # The client_id must match an existing public (non-confidential) client + pass def validate_code(self, client_id, code, client, request, *args, **kwargs): # Validate the code belongs to the client. Add associated scopes pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.

Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy