mirror of
https://github.com/status-im/codimd.git
synced 2025-01-15 02:24:35 +00:00
6ff6d215ab
state parameter is recommended with oauth2 authentification to mitigate CSRF attacks (see [1]). hydra [2] will throw the following error message if state is missing: description="The state is missing or has less than 8 characters and is therefore considered too weak" error=invalid_state hint="Request parameter \"state\" must be at least be 8 characters long to ensure sufficient entropy." [1]: https://auth0.com/docs/protocols/oauth2/oauth-state [2]: https://www.ory.sh/hydra/ Signed-off-by: Samuel Trégouët <samuel.tregouet@gmail.com>
35 lines
1.0 KiB
JavaScript
35 lines
1.0 KiB
JavaScript
'use strict'
|
|
|
|
const Router = require('express').Router
|
|
const passport = require('passport')
|
|
|
|
const config = require('../../config')
|
|
const { setReturnToFromReferer, passportGeneralCallback } = require('../utils')
|
|
const { OAuth2CustomStrategy } = require('./strategy')
|
|
|
|
const oauth2Auth = module.exports = Router()
|
|
|
|
passport.use(new OAuth2CustomStrategy({
|
|
authorizationURL: config.oauth2.authorizationURL,
|
|
tokenURL: config.oauth2.tokenURL,
|
|
clientID: config.oauth2.clientID,
|
|
clientSecret: config.oauth2.clientSecret,
|
|
callbackURL: config.serverURL + '/auth/oauth2/callback',
|
|
userProfileURL: config.oauth2.userProfileURL,
|
|
state: config.oauth2.state,
|
|
scope: config.oauth2.scope
|
|
}, passportGeneralCallback))
|
|
|
|
oauth2Auth.get('/auth/oauth2', function (req, res, next) {
|
|
setReturnToFromReferer(req)
|
|
passport.authenticate('oauth2')(req, res, next)
|
|
})
|
|
|
|
// github auth callback
|
|
oauth2Auth.get('/auth/oauth2/callback',
|
|
passport.authenticate('oauth2', {
|
|
successReturnToOrRedirect: config.serverURL + '/',
|
|
failureRedirect: config.serverURL + '/'
|
|
})
|
|
)
|