Repository navigation
Handle refused and unknown authorizations in the callback - #45
Merged
Merged
Conversation
The callback now returns the browser to the application when the OAuth
server refuses an authorization, and answers states which are malformed,
unknown or already used with status 400. The token request repeats the
redirect URI of the authorization request, and a failed token request
ends in an OAuthClientException.
Previously, the callback required a code. An authorization server which
sent an error instead, for example because the user denied access,
caused a server error. The return URI now carries the error code in the
query parameter flownative_oauth2_error_{serviceType}. Only error codes
which RFC 6749 and OpenID Connect define are passed on, because
applications may display them.
A malformed state made the cache throw, and an unknown or reused state
ended in status 500 with a stack trace in the logs. Both usually come
from a reloaded or bookmarked page, so they now result in status 400.
The redirect URI was rendered again for the token request. If the
browser returned through another host name, the two values differed and
the server rejected the exchange. The URI is now stored with the state.
The client credentials grant no longer sends a redirect URI. Rendering
it outside of a web request without the setting Neos.Flow.http.baseUri
throws a clear exception instead of a TypeError. The putenv() call is
gone, because it changed the environment of the whole process.
The granted scope is taken from the token response. The scope parameter
of the callback URL no longer overrides it, so finishAuthorization()
lost its scope argument. Transport errors and token responses without
JSON are wrapped in an OAuthClientException. The code is no longer
written to the log, because masking it failed for codes shorter than
three characters.
This was referenced Sep 14, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes the callback of the authorization code flow robust against the cases which browsers and authorization servers produce in practice.
When the OAuth server refuses an authorization, for example because the user denied access, the browser now returns to the application with the error code in the query parameter
flownative_oauth2_error_{serviceType}. States which are malformed, unknown or already used result in status 400 instead of a server error.The token request repeats the redirect URI which was stored with the authorization request, and the client credentials grant sends none. Rendering the redirect URI outside of a web request without
Neos.Flow.http.baseUrifails with a clear exception. The granted scope comes from the token response instead of the callback URL, and a failed token request ends in anOAuthClientException.Breaking changes:
finishAuthorization()no longer takes a scope argument,createOAuthProvider()has an additional optional argument, andrenderFinishAuthorizationUri()may throw anOAuthClientException.