浏览代码

chore: comply to RFC 6750 and improve bearer token split (#24955)

tags/2.0.0-beta.1
NeatGuyCoding 1 个月前
父节点
当前提交
a9c7669c16
没有帐户链接到提交者的电子邮件
共有 1 个文件被更改,包括 22 次插入7 次删除
  1. 22
    7
      api/controllers/console/auth/oauth_server.py

+ 22
- 7
api/controllers/console/auth/oauth_server.py 查看文件

@@ -2,7 +2,7 @@ from functools import wraps
from typing import cast

import flask_login
from flask import request
from flask import jsonify, request
from flask_restx import Resource, reqparse
from werkzeug.exceptions import BadRequest, NotFound

@@ -46,23 +46,38 @@ def oauth_server_access_token_required(view):

authorization_header = request.headers.get("Authorization")
if not authorization_header:
raise BadRequest("Authorization header is required")
response = jsonify({"error": "Authorization header is required"})
response.status_code = 401
response.headers["WWW-Authenticate"] = "Bearer"
return response

parts = authorization_header.strip().split(" ")
parts = authorization_header.strip().split(None, 1)
if len(parts) != 2:
raise BadRequest("Invalid Authorization header format")
response = jsonify({"error": "Invalid Authorization header format"})
response.status_code = 401
response.headers["WWW-Authenticate"] = "Bearer"
return response

token_type = parts[0].strip()
if token_type.lower() != "bearer":
raise BadRequest("token_type is invalid")
response = jsonify({"error": "token_type is invalid"})
response.status_code = 401
response.headers["WWW-Authenticate"] = "Bearer"
return response

access_token = parts[1].strip()
if not access_token:
raise BadRequest("access_token is required")
response = jsonify({"error": "access_token is required"})
response.status_code = 401
response.headers["WWW-Authenticate"] = "Bearer"
return response

account = OAuthServerService.validate_oauth_access_token(oauth_provider_app.client_id, access_token)
if not account:
raise BadRequest("access_token or client_id is invalid")
response = jsonify({"error": "access_token or client_id is invalid"})
response.status_code = 401
response.headers["WWW-Authenticate"] = "Bearer"
return response

kwargs["account"] = account


正在加载...
取消
保存