Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Require secrets for confidential clients #36

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Require secrets for confidential clients #36

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b160cd2
Add helpers for secrets to the client
rmccue Jul 11, 2017
a5c85ca
Require a client secret on token endpoint
rmccue Jul 11, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions inc/class-client.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,35 @@ public function get_redirect_uris() {
return (array) get_post_meta( $this->get_post_id(), static::REDIRECT_URI_KEY, true );
}

/**
* Does the client require secrets to be validated?
*
* Clients marked as confidential are required to have their client
* credentials (i.e. secret) checked.
*
* @link https://tools.ietf.org/html/rfc6749#section-3.2.1
*
* @return bool True if secret must be verified, false otherwise.
*/
public function requires_secret() {
$type = $this->get_type();
return $type === 'private';
}

/**
* Check if a secret is valid.
*
* This method ensures that the secret is correctly checked using
* constant-time comparison.
*
* @param string $supplied Supplied secret to check.
* @return boolean True if valid secret, false otherwise.
*/
public function check_secret( $supplied ) {
$stored = $this->get_secret();
return hash_equals( $supplied, $stored );
}

/**
* Validate a callback URL.
*
Expand Down
50 changes: 47 additions & 3 deletions inc/endpoints/class-token.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,18 +54,62 @@ public function validate_grant_type( $type ) {
* @return array|WP_Error Token data on success, or error on failure.
*/
public function exchange_token( WP_REST_Request $request ) {
$client = Client::get_by_id( $request['client_id'] );
// Check headers for client authentication.
// https://tools.ietf.org/html/rfc6749#section-2.3.1
if ( isset( $_SERVER['PHP_AUTH_USER'] ) ) {
$client_id = $_SERVER['PHP_AUTH_USER'];
$client_secret = $_SERVER['PHP_AUTH_PW'];
} else {
$client_id = $request['client_id'];
$client_secret = $request['client_secret'];
}

if ( empty( $client_id ) ) {
// invalid_client
return new WP_Error(
'oauth2.endpoints.token.exchange_token.no_client_id',
__( 'Missing client ID.'),
array(
'status' => WP_Http::UNAUTHORIZED,
)
);
}

$client = Client::get_by_id( $client_id );
if ( empty( $client ) ) {
return new WP_Error(
'oauth2.endpoints.token.exchange_token.invalid_client',
sprintf( __( 'Client ID %s is invalid.', 'oauth2' ), $request['client_id'] ),
sprintf( __( 'Client ID %s is invalid.', 'oauth2' ), $client_id ),
array(
'status' => WP_Http::BAD_REQUEST,
'client_id' => $request['client_id'],
'client_id' => $client_id,
)
);
}

if ( $client->requires_secret() ) {
// Confidential client, secret must be verified.
if ( empty( $client_secret ) ) {
// invalid_request
return new WP_Error(
'oauth2.endpoints.token.exchange_token.secret_required',
__( 'Secret is required for confidential clients.', 'oauth2' ),
array(
'status' => WP_Http::UNAUTHORIZED
)
);
}
if ( ! $client->check_secret( $client_secret ) ) {
return new WP_Error(
'oauth2.endpoints.token.exchange_token.invalid_secret',
__( 'Supplied secret is not valid for the client.', 'oauth2' ),
array(
'status' => WP_Http::UNAUTHORIZED
)
);
}
}

$auth_code = $client->get_authorization_code( $request['code'] );
if ( is_wp_error( $auth_code ) ) {
return $auth_code;
Expand Down