ElyBy-Mirror/oauth2-server
1
0
Fork 0
mirror of https://github.com/elyby/oauth2-server.git synced 2024-11-01 16:33:07 +05:30
Code Issues Packages Projects Releases Wiki Activity

Don’t pad and shuffle the payload if an encryption key has been set

Browse Source
This commit is contained in:
Alex Bilbie 2017-07-01 16:37:53 +01:00
parent e123fe82d0
commit 0706d66c76
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/Grant/AuthCodeGrant.php
View File

@ -320,9 +320,11 @@ class AuthCodeGrant extends AbstractAuthorizeGrant
'expire_time' => (new \DateTime())->add($this->authCodeTTL)->format('U'), 'expire_time' => (new \DateTime())->add($this->authCodeTTL)->format('U'),
'code_challenge' => $authorizationRequest->getCodeChallenge(), 'code_challenge' => $authorizationRequest->getCodeChallenge(),
'code_challenge_method ' => $authorizationRequest->getCodeChallengeMethod(), 'code_challenge_method ' => $authorizationRequest->getCodeChallengeMethod(),
'_padding' => base64_encode(random_bytes(mt_rand(8, 256)))
]; ];
if ($this->encryptionKey === null) {
// Add padding to vary the length of the payload
$payload['_padding'] = base64_encode(random_bytes(mt_rand(8, 256)));
// Shuffle the payload so that the structure is no longer know and obvious // Shuffle the payload so that the structure is no longer know and obvious
$keys = array_keys($payload); $keys = array_keys($payload);
shuffle($keys); shuffle($keys);
@ -330,6 +332,9 @@ class AuthCodeGrant extends AbstractAuthorizeGrant
foreach ($keys as $key) { foreach ($keys as $key) {
$shuffledPayload[$key] = $payload[$key]; $shuffledPayload[$key] = $payload[$key];
} }
} else {
$shuffledPayload = $payload;
}
$response = new RedirectResponse(); $response = new RedirectResponse();
$response->setRedirectUri( $response->setRedirectUri(