cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: encoding of basic auth header values

Browse source
This commit is contained in:
Livio Amstutz 2021-03-05 07:44:37 +01:00
parent 527dd7b604
commit d7d7daab2d
3 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
pkg/op/token_intospection.go
View file

@ -3,6 +3,7 @@ package op
import (
"errors"
"net/http"
"net/url"
"github.com/caos/oidc/pkg/oidc"
"github.com/caos/oidc/pkg/utils"
@ -68,6 +69,14 @@ func ParseTokenIntrospectionRequest(r *http.Request, introspector Introspector)
}
clientID, clientSecret, ok := r.BasicAuth()
if ok {
clientID, err = url.QueryUnescape(clientID)
if err != nil {
return "", "", errors.New("invalid basic auth header")
}
clientSecret, err = url.QueryUnescape(clientSecret)
if err != nil {
return "", "", errors.New("invalid basic auth header")
}
if err := introspector.Storage().AuthorizeClientIDSecret(r.Context(), clientID, clientSecret); err != nil {
return "", "", err
}