Lukáš Unger
577065c270
Use native typehints
2018-05-08 11:35:06 +02:00
Lukáš Unger
a1da9beb92
Removed convertToJWT() method from AccessTokenEntityInterface
2018-05-07 20:37:20 +02:00
Andrew Millington
48ce5f36cf
Change function name to be less technically specific
2018-05-07 20:37:20 +02:00
Lukáš Unger
fd72d79ad3
Generalized access token format
2018-05-07 20:37:20 +02:00
Andrew Millington
52d7952ba5
Merge pull request #893 from Sephster/fix-exception-hint
...
Change hint so it applies to both the auth and access token requests
2018-04-21 22:02:09 +01:00
Andrew Millington
242dd4dcfe
Fix docblock
2018-04-21 21:51:25 +01:00
Andrew Millington
491c23c1e9
Merge remote-tracking branch 'upstream/master' into phpstan-level-7
2018-04-21 21:37:24 +01:00
Andrew Millington
27323b5c9a
Fix spacing issue
2018-04-21 21:31:48 +01:00
Andrew Millington
80bc291c51
Added null checks before calling set functions
2018-04-21 21:29:21 +01:00
Andrew Millington
8a619e5c1e
Change hint so it applies to both the auth and access token requests
2018-04-21 18:07:38 +01:00
Andrew Millington
6991777ff3
Fix blank line spacing issue
2018-04-20 18:33:46 +01:00
Andrew Millington
9febc32e14
Add spacing around logical blocks
2018-04-20 18:27:47 +01:00
Andrew Millington
c8b44ff5c7
Revert fix for client ID exception
2018-04-20 18:22:07 +01:00
Andrew Millington
a56acc8dd0
Minor code tidy up
2018-02-28 20:33:19 +00:00
Andrew Millington
c9b07f386c
Fix StyleCI issues and remove phpdoc order from StyleCI
2018-02-28 20:01:01 +00:00
Andrew Millington
00a7972f74
Merge remote-tracking branch 'upstream/master'
2018-02-28 19:45:41 +00:00
Andrew Millington
6fd3024c48
Merge pull request #860 from Zaszczyk/new-events-to-emitter-#825
...
Add new event types: access_token_issued and refresh_token_issued.
2018-02-26 20:01:22 +00:00
Andrew Millington
62e06b7d3a
Removing Yoda condition
...
Removed Yoda condition from code base
2018-02-26 19:51:03 +00:00
Simon Hamp
009c109716
TravisCI fix for PHPStan
2018-02-26 16:04:48 +00:00
Simon Hamp
6723aadfe8
Fix #837
...
Unifies how we fetch the client_id from the request and allows us to throw a more appropriate exception when the client_id parameter is missing.
Improves the test method for this validation by checking the culpable method in this particular case. The test was missing this by calling the wrong method.
2018-02-26 15:56:28 +00:00
Mateusz Błaszczyk
6700b113a8
Add new event types: access_token_issued and refresh_token_issued.
2018-02-23 17:48:51 +01:00
Lukáš Unger
143afc9561
PHPStan level 7
2018-02-18 21:20:48 +01:00
Andrew Millington
e0cc5ee1b0
Merge branch 'master' of https://github.com/thephpleague/oauth2-server into fix-pkce-implementation
2018-02-18 13:57:19 +00:00
Andrew Millington
25c3c216a0
Apply fixes from StyleCI
2018-02-17 19:31:59 +00:00
Lukáš Unger
cd5233392e
Updated dependencies, more strict static analysis
2018-02-17 18:07:16 +01:00
Andrew Millington
7a6c35bc29
Merge pull request #849 from lookyman/phpunit-version
...
Update PHPUnit, run static analysis on tests
2018-02-17 16:28:41 +00:00
Andrew Millington
8614aea887
Revert "Remove temp variables and @var comments"
...
This reverts commit 7a5c511807
2018-02-17 16:27:41 +00:00
Andrew Millington
7a5c511807
Remove temp variables and @var comments
2018-02-17 16:15:48 +00:00
Andrew Millington
e0b65a2831
Set default mustValidateSecret to true
2018-02-17 11:46:47 +00:00
Andrew Millington
ee7d52ecaa
Merge pull request #607 from lucadegasperi/patch-5
...
Make ClientRepositoryInterface more flexible
2018-02-17 11:42:48 +00:00
Bruce Weirdan
80a949601f
Fixed docblock opener
...
It's important for tools relying on docblock types to perform static analysis (think phan, phpstan, psalm, etc)
2018-02-12 12:36:59 +02:00
Andrew Millington
fea577f25b
Merge pull request #719 from stratoss/stratoss-patch-exeption
...
Getter and setter for the payload and ability to pass options to json_encode
2018-02-11 22:48:23 +00:00
Lukáš Unger
1f87c7a7be
Update PHPUnit, run static analysis on tests
2018-02-11 23:22:46 +01:00
Andrew Millington
3098f6d7fa
Merge pull request #839 from simesy/master
...
Allow other secure key permissions.
2018-02-11 22:17:35 +00:00
Andrew Millington
06a23a1dd0
Update CryptKey.php
...
Change the error message to reflect that the server will also accept 440 and 400 as a valid file permission
2018-02-11 22:12:55 +00:00
Alex Bilbie
97089ad49e
Merge pull request #848 from lookyman/static-analysis
...
Static analysis with PHPStan
2018-02-11 21:24:52 +00:00
Lukáš Unger
eca385ab08
Static analysis with PHPStan
2018-02-11 22:20:17 +01:00
Andrew Millington
ef06c29ee8
Merge pull request #840 from liverbool/master
...
BUGFIX: Wrong redirect uri.
2018-02-11 20:20:41 +00:00
Andrew Millington
5fb9fc929a
Reinstate check on client redirect URI to fail if multiple redirect URIs have been listed for the client and one has not been specified in the auth request
2018-02-11 20:10:01 +00:00
liverbool
b3cd73cac7
code cleaner
...
cc.
Co-Authored-By: Andrew Millington <sephster@users.noreply.github.com>
2018-02-09 05:54:05 +07:00
Erick Torres
ce2662ece7
Merge branch 'master' of github.com:thephpleague/oauth2-server into fix-pkce-implementation
...
# Conflicts:
# tests/Grant/AuthCodeGrantTest.php
2018-02-05 15:32:15 -05:00
Karim PINCHON
d2641b560d
Do not create key file if it already exists and it is the same
2018-01-29 11:05:10 +01:00
Andrew Millington
8bbd218856
Merge pull request #842 from sgomez/fix-challenge-pkce
...
Fix S256 code challenge method
2018-01-25 23:16:15 +00:00
Andrew Millington
eb9cde5ab7
Merge pull request #805 from raarts/Accept-RSA-key-with-crlf-v2
...
Also accept an RSA key with crlf
2018-01-23 22:24:52 +00:00
Sergio Gómez
1b692e2298
Fix S256 code challenge method
...
According to [RFC7636#section-4.3](https://tools.ietf.org/html/rfc7636#section-4.3 ):
If the "code_challenge_method" from Section 4.3 was "S256", the
received "code_verifier" is hashed by SHA-256, base64url-encoded, and
then compared to the "code_challenge", i.e.:
BASE64URL-ENCODE(SHA256(ASCII(code_verifier))) == code_challenge
So, the hash must be done before the base64_encode.
The tests are modified to use example data from the
[RFC7636#appendix-B](https://tools.ietf.org/html/rfc7636#appendix-B ).
2018-01-18 05:31:44 +01:00
liverbool
d22f222e65
BUGFIX: Wrong redirect uri.
...
This's bugfix when redirect on error.
2018-01-13 11:52:31 +07:00
Simon Hobbs
cf9acb32b8
Allow some more secure options without tsk-tsk.
2018-01-13 15:29:42 +11:00
SunMar
292272d128
Allow CryptTrait to accept a \Defuse\Crypto\Key as encryption key #812
2018-01-04 15:14:03 +01:00
Ron Arts
ef8a741527
In public/private keys, force the header to be on its own line, allow missing \n after the footer
2018-01-04 12:17:31 +01:00
Ron Arts
91d9c11fb4
Fixed tests, allow whitespace at the end of a key
2018-01-03 10:18:32 +01:00
Andrew Millington
b6d9835281
Merge branch 'master' into fix-pkce-implementation
2017-12-28 16:37:37 +00:00
Andrew Millington
a0cabb573c
Update AbstractGrant.php
...
Temporarily removing check on empty scopes as causing issues for Passport users
2017-12-23 23:33:42 +00:00
Andrew Millington
1c36b70dab
Fixed ordering so we only hash after base64 encoding
2017-12-23 02:06:18 +00:00
Andrew Millington
f11e4c81cd
Merge pull request #697 from fkooman/fix-s256
...
Fix PKCE code verifier encoding to match specification
2017-12-23 01:52:33 +00:00
Iman
f88961eddd
flatten code
2017-11-23 21:26:39 +03:30
Andrew Millington
8c93fd74c9
Merge pull request #573 from ismailbaskin/master
...
Include redirect_uri check on authorization endpoint
2017-11-19 20:57:27 +00:00
Andrew Millington
2765481b9f
Handle no scope hint
2017-11-18 18:47:38 +00:00
Andrew Millington
9273936009
Fix bug where not specifying the bad scope
2017-11-18 18:46:03 +00:00
Sephster
6e6baf5b75
Remove abstract authorize grant use
2017-11-13 23:57:24 +00:00
Sephster
7878cf9c13
Merge remote-tracking branch 'upstream/master'
2017-11-13 23:52:36 +00:00
Sephster
eb645063c7
Reverted the abstract authorise grant to its previous state
2017-11-13 22:25:31 +00:00
Sephster
512d4898e2
Revert previous change
2017-11-13 22:20:16 +00:00
Sephster
c895885700
Modify grants so only auth requests use default scopes
2017-11-13 22:19:44 +00:00
Andrew Millington
0f08063864
Fixed use of default scope so it is only for authorization requests
2017-11-06 22:33:28 +00:00
Andrew Millington
cc6eb63dd8
Remove default scope from the Refresh Token Grant
2017-11-06 21:23:52 +00:00
Andrew Millington
093c7755fa
Remove default scope from the Password Grant
2017-11-06 21:23:14 +00:00
Andrew Millington
82b81c7f6f
Remove setDefaultScope function from the grant interface
2017-11-06 21:22:09 +00:00
Andrew Millington
9cd86a9154
Remove default scope for the ClientCredentialsGrant
2017-11-06 21:21:14 +00:00
Andrew Millington
42ea0de9fb
Add default scope to the AbstractAuthorizeGrant
2017-11-06 21:19:38 +00:00
Andrew Millington
ab760a805c
Remove default scope from abstract grant
...
This should be added to the AbstractAuthorizeGrant instead as it is
only used for an authorization request
2017-11-06 21:19:07 +00:00
Andrew Millington
ac48653bb5
Merge pull request #797 from thephpleague/Update-Readme
...
Update readme file to bring in Andy, Brian, and Simon
2017-11-05 11:52:28 +00:00
Andrew Millington
4806eda45a
Change to throw invalid scope instead of missing scope exception
2017-10-31 22:59:01 +00:00
Andrew Millington
b2fe909a71
Removed the missing scope exception as should be using invalid_scope
2017-10-31 22:58:07 +00:00
Ron Arts
f79d3f27cf
Incorporate https://github.com/thephpleague/oauth2-server/pull/731 . Thanks.
...
Now can handle cr/lf, cr, and lf endings. And on php5 large keys as well.
2017-10-31 10:14:46 +01:00
Andrew Millington
3828f87b19
Fix tests as no longer set the default scope in the constructor
...
Use new setDefaultScope() method instead. Also changed default scope to
be a blank string instead of null
2017-10-30 23:48:02 +00:00
Andrew Millington
a49f6ff80d
Remove setting default scope in the constructor
2017-10-30 23:36:19 +00:00
Ron Arts
4563685375
Also accept an RSA key with crlf
2017-10-30 16:21:17 +01:00
Luca Santarella
a4fc05c31e
Fixed indentation in comment to match code style
2017-10-25 18:33:54 -04:00
Luca Santarella
825017f27e
Ability to specify query delimiter, such as ? instead of the hard-coded #
2017-10-25 18:30:17 -04:00
Brian Retterer
23c7138d48
Apply fixes from StyleCI
2017-10-23 15:26:10 +00:00
Andrew Millington
63861704b6
Merge pull request #749 from dmelo/issue-748
...
Replaces array_key_exists by isset, which is faster, on ImplicitGrant.
2017-10-20 18:28:18 +01:00
Diogo Oliveira de Melo
203be5ca20
Revert comparison order, as suggested by @Sephster
2017-10-20 09:23:36 -02:00
Andrew Millington
5a28fb8af4
Set a default scope for the authorization server
2017-10-18 22:09:53 +01:00
Andrew Millington
c996b66528
Add means to set default scopes for grants
2017-10-18 22:08:41 +01:00
Andrew Millington
c70451abd5
Add an exception for a missing scope
2017-10-18 22:08:11 +01:00
Andrew Millington
e7ee483d11
Changed function comment to reflect we are setting the public, instead of private key
2017-10-13 23:02:29 +01:00
Erick Torres
4270f5bac1
Merge branch 'master' of github.com:erickjth/oauth2-server into fix-pkce-implementation
...
# Conflicts:
# src/Grant/AuthCodeGrant.php
2017-09-07 17:24:48 -05:00
Alex Bilbie
3b58ab1df2
Merge pull request #724 from davedevelopment/change-token-type-case
...
Change case for implict grant token_type
2017-08-11 08:16:08 +01:00
Alex Bilbie
c86c7dde70
Fix #759
2017-08-03 16:07:11 +01:00
Alex Bilbie
e184691ded
Merge pull request #776 from yannickl88/fix/perm-key-check
...
Removed chmod from CryptKey and add toggle to disable checking
2017-08-03 16:04:08 +01:00
Yannick de Lange
2aca909d20
Removed chmod from CryptKey and add toggle to disable checking
2017-08-03 15:57:39 +02:00
Hugo Hamon
79038ced78
[BC Break] Fixes invalid code challenge method payload key name
...
I guess this change might be a BC break for existing and active authorization tokens when they're validated by the server. The good thing is that an authorization token has a very short expiration time and is used once to request an access token.
2017-08-02 17:55:11 +02:00
Benjamin Dieleman
ecc07abb33
Updated PHPDoc about the unicity violation exception throwing
...
UniqueTokenIdentifierConstraintViolationException can be thrown when persisting tokens
2017-07-27 17:31:01 +02:00
Alex Bilbie
80fc8e654b
Trigger E_USER_NOTICE instead of throwing an exception if key cannot be chmod to 600
2017-07-19 07:57:47 +01:00
Erick Torres
88ccb6ff13
Fix codeVerifier check. Keep code style.
2017-07-07 12:35:42 -05:00
Erick Torres
fbb3586cae
Merge branch 'master' of github.com:erickjth/oauth2-server into fix-pkce-implementation
...
# Conflicts:
# src/Grant/AuthCodeGrant.php
# tests/Grant/AuthCodeGrantTest.php
2017-07-07 12:06:32 -05:00
Jérôme Parmentier
88bf8b2367
Fix missing sprintf
2017-07-03 20:28:28 +02:00
Alex Bilbie
f5c3ba0b24
Removed dead code
2017-07-01 18:22:51 +01:00
Alex Bilbie
523434902c
Removed dead code
2017-07-01 18:15:41 +01:00
Alex Bilbie
76c2b6f88c
AuthorizationServer no longer needs to know about the public key
2017-07-01 18:11:10 +01:00
Alex Bilbie
72349ef22f
Encryption key is now always required so remove redundent code
2017-07-01 18:10:53 +01:00
Alex Bilbie
850793ab88
Added missing methods
2017-07-01 18:08:49 +01:00
Alex Bilbie
0f73bf0054
Encryption key just uses Defuse\Crypto now, no key based crypto
2017-07-01 18:07:51 +01:00
Alex Bilbie
aee1779432
Apply fixes from StyleCI
2017-07-01 16:19:23 +00:00
Alex Bilbie
765a01021b
Updated error message
2017-07-01 16:45:29 +01:00
Alex Bilbie
0706d66c76
Don’t pad and shuffle the payload if an encryption key has been set
2017-07-01 16:45:29 +01:00
Alex Bilbie
e123fe82d0
Ignore error_log messages in code coverage
2017-07-01 16:45:29 +01:00
Alex Bilbie
1954120c3d
Use catch all exception
2017-07-01 16:45:29 +01:00
Alex Bilbie
dd5eee150d
Ensure response type also has access to the encryption key
2017-07-01 16:45:29 +01:00
Alex Bilbie
1af4012df4
New property on AuthorizationServer to receive an encryption key which is used for future encryption/decryption instead of keybased encryption/decryption
2017-07-01 16:45:29 +01:00
Alex Bilbie
4a717104fa
Shuffle the contents of the authorization code payload
2017-07-01 16:45:29 +01:00
Alex Bilbie
63530443fe
Better error checking when saving a temporary key to ensure file was written successfully and the server is the exclusive mode
2017-07-01 16:44:57 +01:00
Alex Bilbie
2f8de3d230
Ensure the server is the exclusive owner of the key
2017-07-01 16:44:51 +01:00
Alex Bilbie
57d199b889
Stricter validation of code challenge value to match RFC 7636 requirements
2017-07-01 16:44:43 +01:00
Alex Bilbie
6bdd108145
Escape scope parameter to reduce pontential XSS vector
2017-07-01 16:43:31 +01:00
Diogo Oliveira de Melo
170ce2fd2d
Replaces array_key_exists by isset, which is faster, on ImplicitGrant.
2017-06-30 15:42:23 -03:00
Erick Torres
880e3b4590
Fix invalid code_challenge_method key.
2017-06-16 12:03:04 -05:00
Erick Torres
2167edf1d9
Validate codeVerifier and codeChallenge correctly.
2017-06-16 12:02:48 -05:00
Erick Torres
2482630221
Fix codeVerifier hash verification.
2017-06-16 12:02:34 -05:00
Dave Marshall
83228bdcd5
Change case for implict grant token_type
2017-03-27 12:11:25 +01:00
Stanimir Stoyanov
d73b15ae32
Getter and setter for the payload and ability to pass options to json_encode
2017-03-20 14:52:35 +02:00
Ian Littman
d8ece093d5
Add hasRedirect() method for OAuthServerException
...
Resolves #694 .
2017-02-04 14:50:46 -05:00
François Kooman
6426e597a3
Fix PKCE code verifier encoding to match specification
...
The current implementation of PKCE does not follow the specification
correctly regarding the encoding of the code verifier. This patch
correctly encodes the hash of the code verifier according to
Appenix A of RFC 7636.
2017-01-24 11:36:34 +01:00
jeremykendall
01677a564e
Fix WWW-Authenticate entry in $headers array
...
In this context the header name should be the array key and the header
value the array value.
2016-10-11 22:27:24 -05:00
Alex Bilbie
b1bfff7325
Don't pass in user because we don't know who user is
2016-09-19 10:05:55 +01:00
Alex Bilbie
11ccc305d0
Applied fixes from StyleCI
2016-09-13 14:17:09 +00:00
Alex Bilbie
d7df2f7e24
Fix for #650
2016-09-13 15:16:58 +01:00
Julián Gutiérrez
065ef5db99
CryptKey tests
2016-07-19 17:15:36 +02:00
Julián Gutiérrez
039537ebe2
touch!
2016-07-19 15:06:32 +02:00
Julián Gutiérrez
d8930af5ee
key file auto-generation from string
2016-07-19 15:01:31 +02:00
Ian Littman
090c01d3d1
Allow easy addition of custom fields to Bearer token response
2016-07-16 10:27:33 -05:00
Pierre Rineau
57323f38f7
while(array_shift()) makes the AuthorizationServer class configuration mutable
2016-07-13 12:03:05 +02:00
Lukáš Unger
c874c59b9c
Explicitly compare to false when checking not instanceof
2016-07-09 12:09:21 +02:00
Lukáš Unger
c3a4670c11
Updated PHPDoc
2016-07-09 02:01:53 +02:00
Luca Degasperi
655a4b2715
Make ClientRepositoryInterface more flexible
...
This small change will allow the use of the ```ClientRepositoryInterface``` for more use cases than simply validating clients when authorizing them. There might be some places where this change will affect the behavior. I also think the ```$mustValidateSecret``` is redundant since in an implementation a check could be done wether ```$clientSecret``` is null or not.
2016-06-30 16:49:47 +02:00
Alex Bilbie
5ee1583c5b
Ensure state is in access denied redirect. Fixes #597
2016-06-28 09:03:01 +01:00
Alex Bilbie
66de05a395
Merge pull request #605 from jfilla/master
...
Added catch Runtime exception when parsing JWT string
2016-06-28 08:49:29 +01:00
Alex Bilbie
df20da1235
Merge pull request #601 from zerkms/ISSUE-596_UNIQUE_ACCESS_TOKEN
...
Added a check for unique access token constraint violation
2016-06-28 08:48:38 +01:00
Jakub Filla
9eccc40eb6
Added catch Runtime exception when parsing JWT string
2016-06-22 12:38:03 +02:00
Ian Littman
9775c0076b
Look at Authorization header directly for HTTP Basic auth check
...
Should allow for better compatibility with server implementations that aren't sitting on top of a standard SAPI (e.g. persistent web servers building a PSR-7 compatible request from a socket-received message).
One catch here is that I've seen Apache hijack the HTTP Authorization header in the past, though that would probably impact the other aspects of the server just as much as it would this, so I think that risk is manageable.
Added tests to cover all paths through the new code, so the AbstractGrant type still has 100% coverage :)
Did notice that, as of the latest versions of PHPUnit, the mock creation method is deprecated. Maybe that needs to be updated? Haven't checked to see whether the replacements are PHPUnit 4.8 compatible though, so maybe they need to stay in order to test on older PHP versions?
2016-06-21 21:08:38 -05:00
Ivan Kurnosov
b68ef973df
Added a check for unique access token constraint violation
2016-06-20 20:19:03 +12:00
Ivan Kurnosov
6b88cbeb13
Removed isExpired() from interfaces and traits
2016-06-17 19:50:04 +12:00
Julián Gutiérrez
22e6a350dd
unify middleware exception responses
2016-05-11 14:13:58 +02:00
İsmail BASKIN
9a58bc15f6
Include redirect_uri check on authorization endpoint on implicit grant
2016-05-07 17:44:02 +03:00
Alex Bilbie
8e8aed1a50
Implemented RFC7636. Fixes #574
2016-05-06 15:23:16 +01:00
İsmail BASKIN
7285ede563
Include redirect_uri check on authorization endpoint
2016-05-04 13:34:37 +03:00
Alex Bilbie
db055f790d
Revert "Remove redundant parameters in example" #553
...
This reverts commit 9a93dca05c
2016-05-04 09:10:05 +01:00
Alex Bilbie
cf63403585
Merge branch 'master' of github.com:thephpleague/oauth2-server
2016-05-04 08:56:04 +01:00
Alex Bilbie
cdf43e498e
Use constant for event name instead of explicit string. Fixes #563
2016-05-04 08:55:57 +01:00
Alex Bilbie
a12fc98b0d
Merge pull request #569 from ismailbaskin/patch-2
...
Correct wrong phpdoc
2016-05-04 08:45:58 +01:00
