status-im
/
codimd
mirror of https://github.com/status-im/codimd.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

fix: add state parameter for oauth2 

state parameter is recommended with oauth2 authentification
to mitigate CSRF attacks (see [1]).
hydra [2] will throw the following error message if state is
missing:

  description="The state is missing or has less than 8 characters and is therefore considered too weak" error=invalid_state hint="Request
 parameter \"state\" must be at least be 8 characters long to ensure sufficient entropy."

[1]: https://auth0.com/docs/protocols/oauth2/oauth-state
[2]: https://www.ory.sh/hydra/

Signed-off-by: Samuel Trégouët <samuel.tregouet@gmail.com>
This commit is contained in:
Samuel Trégouët 2020-05-11 15:57:58 +02:00
parent a6c7582aa2
commit 6ff6d215ab
3 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
lib/auth/oauth2/index.js
View File

@ -16,6 +16,7 @@ passport.use(new OAuth2CustomStrategy({
clientSecret: config.oauth2.clientSecret, clientSecret: config.oauth2.clientSecret,
callbackURL: config.serverURL + '/auth/oauth2/callback', callbackURL: config.serverURL + '/auth/oauth2/callback',
userProfileURL: config.oauth2.userProfileURL, userProfileURL: config.oauth2.userProfileURL,
state: config.oauth2.state,
scope: config.oauth2.scope scope: config.oauth2.scope
}, passportGeneralCallback)) }, passportGeneralCallback))

1
lib/config/default.js
View File

@ -100,6 +100,7 @@ module.exports = {
userProfileDisplayNameAttr: 'displayName', userProfileDisplayNameAttr: 'displayName',
userProfileEmailAttr: 'email', userProfileEmailAttr: 'email',
userProfilePhotoAttr: 'photo', userProfilePhotoAttr: 'photo',
state: true,
scope: 'email' scope: 'email'
}, },
facebook: { facebook: {

1
lib/config/environment.js
View File

@ -94,6 +94,7 @@ module.exports = {
tokenURL: process.env.CMD_OAUTH2_TOKEN_URL, tokenURL: process.env.CMD_OAUTH2_TOKEN_URL,
userProfileURL: process.env.CMD_OAUTH2_USER_PROFILE_URL, userProfileURL: process.env.CMD_OAUTH2_USER_PROFILE_URL,
scope: process.env.CMD_OAUTH2_SCOPE, scope: process.env.CMD_OAUTH2_SCOPE,
state: process.env.CMD_OAUTH2_STATE,
userProfileUsernameAttr: process.env.CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR, userProfileUsernameAttr: process.env.CMD_OAUTH2_USER_PROFILE_USERNAME_ATTR,
userProfileDisplayNameAttr: process.env.CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR, userProfileDisplayNameAttr: process.env.CMD_OAUTH2_USER_PROFILE_DISPLAY_NAME_ATTR,
userProfileEmailAttr: process.env.CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR, userProfileEmailAttr: process.env.CMD_OAUTH2_USER_PROFILE_EMAIL_ATTR,