tsai
/
openiddict-core
mirror of https://github.com/openiddict/openiddict-core.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
Browse Source

Backport the cancellation tokens changes to OpenIddict 1.x

pull/553/head
Kévin Chalet 9 years ago
parent
43b00fcf31 611e4a521a
commit
6f29a453b9
6 changed files with 31 additions and 38 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Split View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 2
      samples/Mvc.Server/Controllers/AuthorizationController.cs
  2. 28
      src/OpenIddict/OpenIddictProvider.Authentication.cs
  3. 15
      src/OpenIddict/OpenIddictProvider.Exchange.cs
  4. 11
      src/OpenIddict/OpenIddictProvider.Introspection.cs
  5. 11
      src/OpenIddict/OpenIddictProvider.Revocation.cs
  6. 2
      src/OpenIddict/OpenIddictProvider.Session.cs

2
samples/Mvc.Server/Controllers/AuthorizationController.cs
View File

@ -58,7 +58,7 @@ namespace Mvc.Server
"Make sure services.AddOpenIddict().AddMvcBinders() is correctly called.");
// Retrieve the application details from the database.
var application = await _applicationManager.FindByClientIdAsync(request.ClientId, HttpContext.RequestAborted);
var application = await _applicationManager.FindByClientIdAsync(request.ClientId);
if (application == null)
{
return View("Error", new ErrorViewModel

28
src/OpenIddict/OpenIddictProvider.Authentication.cs
View File

@ -259,7 +259,7 @@ namespace OpenIddict
}
// Retrieve the application details corresponding to the requested client_id.
var application = await applications.FindByClientIdAsync(context.ClientId, context.HttpContext.RequestAborted);
var application = await applications.FindByClientIdAsync(context.ClientId);
if (application == null)
{
logger.LogError("The authorization request was rejected because the client " +
@ -280,7 +280,7 @@ namespace OpenIddict
// the authorization endpoint are rejected if the client_id corresponds to a confidential application.
// Note: when using the authorization code grant, ValidateTokenRequest is responsible of rejecting
// the token request if the client_id corresponds to an unauthenticated confidential client.
if (await applications.IsConfidentialAsync(application, context.HttpContext.RequestAborted) &&
if (await applications.IsConfidentialAsync(application) &&
(context.Request.HasResponseType(OpenIdConnectConstants.ResponseTypes.IdToken) ||
context.Request.HasResponseType(OpenIdConnectConstants.ResponseTypes.Token)))
{
@ -292,8 +292,7 @@ namespace OpenIddict
}
// Reject the request if the application is not allowed to use the authorization endpoint.
if (!await applications.HasPermissionAsync(application,
OpenIddictConstants.Permissions.Endpoints.Authorization, context.HttpContext.RequestAborted))
if (!await applications.HasPermissionAsync(application, OpenIddictConstants.Permissions.Endpoints.Authorization))
{
logger.LogError("The authorization request was rejected because the application '{ClientId}' " +
"was not allowed to use the authorization endpoint.", context.ClientId);
@ -306,8 +305,8 @@ namespace OpenIddict
}
// Reject the request if the application is not allowed to use the authorization code flow.
if (context.Request.IsAuthorizationCodeFlow() && !await applications.HasPermissionAsync(application,
OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode, context.HttpContext.RequestAborted))
if (context.Request.IsAuthorizationCodeFlow() && !await applications.HasPermissionAsync(
application, OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode))
{
logger.LogError("The authorization request was rejected because the application '{ClientId}' " +
"was not allowed to use the authorization code flow.", context.ClientId);
@ -320,8 +319,8 @@ namespace OpenIddict
}
// Reject the request if the application is not allowed to use the implicit flow.
if (context.Request.IsImplicitFlow() && !await applications.HasPermissionAsync(application,
OpenIddictConstants.Permissions.GrantTypes.Implicit, context.HttpContext.RequestAborted))
if (context.Request.IsImplicitFlow() && !await applications.HasPermissionAsync(
application, OpenIddictConstants.Permissions.GrantTypes.Implicit))
{
logger.LogError("The authorization request was rejected because the application '{ClientId}' " +
"was not allowed to use the implicit flow.", context.ClientId);
@ -334,11 +333,9 @@ namespace OpenIddict
}
// Reject the request if the application is not allowed to use the authorization code/implicit flows.
if (context.Request.IsHybridFlow() &&
(!await applications.HasPermissionAsync(application,
OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode, context.HttpContext.RequestAborted) ||
!await applications.HasPermissionAsync(application,
OpenIddictConstants.Permissions.GrantTypes.Implicit, context.HttpContext.RequestAborted)))
if (context.Request.IsHybridFlow() &&
(!await applications.HasPermissionAsync(application, OpenIddictConstants.Permissions.GrantTypes.AuthorizationCode) ||
!await applications.HasPermissionAsync(application, OpenIddictConstants.Permissions.GrantTypes.Implicit)))
{
logger.LogError("The authorization request was rejected because the application '{ClientId}' " +
"was not allowed to use the hybrid flow.", context.ClientId);
@ -353,8 +350,7 @@ namespace OpenIddict
// Reject the request if the offline_access scope was request and if the
// application is not allowed to use the authorization code/implicit flows.
if (context.Request.HasScope(OpenIdConnectConstants.Scopes.OfflineAccess) &&
!await applications.HasPermissionAsync(application,
OpenIddictConstants.Permissions.GrantTypes.RefreshToken, context.HttpContext.RequestAborted))
!await applications.HasPermissionAsync(application, OpenIddictConstants.Permissions.GrantTypes.RefreshToken))
{
logger.LogError("The authorization request was rejected because the application '{ClientId}' " +
"was not allowed to request the 'offline_access' scope.", context.ClientId);
@ -368,7 +364,7 @@ namespace OpenIddict
// Ensure that the specified redirect_uri is valid and is associated with the client application.
if (!await applications.ValidateRedirectUriAsync(application, context.RedirectUri, context.HttpContext.RequestAborted))
if (!await applications.ValidateRedirectUriAsync(application, context.RedirectUri))
{
logger.LogError("The authorization request was rejected because the redirect_uri " +
"was invalid: '{RedirectUri}'.", context.RedirectUri);

15
src/OpenIddict/OpenIddictProvider.Exchange.cs
View File

@ -122,7 +122,7 @@ namespace OpenIddict
}
// Retrieve the application details corresponding to the requested client_id.
var application = await applications.FindByClientIdAsync(context.ClientId, context.HttpContext.RequestAborted);
var application = await applications.FindByClientIdAsync(context.ClientId);
if (application == null)
{
logger.LogError("The token request was rejected because the client " +
@ -140,8 +140,7 @@ namespace OpenIddict
context.Request.SetProperty($"{OpenIddictConstants.Properties.Application}:{context.ClientId}", application);
// Reject the request if the application is not allowed to use the token endpoint.
if (!await applications.HasPermissionAsync(application,
OpenIddictConstants.Permissions.Endpoints.Token, context.HttpContext.RequestAborted))
if (!await applications.HasPermissionAsync(application, OpenIddictConstants.Permissions.Endpoints.Token))
{
logger.LogError("The token request was rejected because the application '{ClientId}' " +
"was not allowed to use the token endpoint.", context.ClientId);
@ -155,7 +154,7 @@ namespace OpenIddict
// Reject the request if the application is not allowed to use the specified grant type.
if (!await applications.HasPermissionAsync(application,
OpenIddictConstants.Permissions.Prefixes.GrantType + context.Request.GrantType, context.HttpContext.RequestAborted))
OpenIddictConstants.Permissions.Prefixes.GrantType + context.Request.GrantType))
{
logger.LogError("The token request was rejected because the application '{ClientId}' was not allowed to " +
"use the specified grant type: {GrantType}.", context.ClientId, context.Request.GrantType);
@ -167,7 +166,7 @@ namespace OpenIddict
return;
}
if (await applications.IsPublicAsync(application, context.HttpContext.RequestAborted))
if (await applications.IsPublicAsync(application))
{
// Note: public applications are not allowed to use the client credentials grant.
if (context.Request.IsClientCredentialsGrantType())
@ -219,7 +218,7 @@ namespace OpenIddict
return;
}
if (!await applications.ValidateClientSecretAsync(application, context.ClientSecret, context.HttpContext.RequestAborted))
if (!await applications.ValidateClientSecretAsync(application, context.ClientSecret))
{
logger.LogError("The token request was rejected because the confidential or hybrid application " +
"'{ClientId}' didn't specify valid client credentials.", context.ClientId);
@ -270,7 +269,7 @@ namespace OpenIddict
// If the authorization code/refresh token is already marked as redeemed, this may indicate that
// it was compromised. In this case, revoke the authorization and all the associated tokens.
// See https://tools.ietf.org/html/rfc6749#section-10.5 for more information.
if (await tokens.IsRedeemedAsync(token, context.HttpContext.RequestAborted))
if (await tokens.IsRedeemedAsync(token))
{
// Try to revoke the authorization and the associated tokens.
// If the operation fails, the helpers will automatically log
@ -291,7 +290,7 @@ namespace OpenIddict
return;
}
else if (!await tokens.IsValidAsync(token, context.HttpContext.RequestAborted))
else if (!await tokens.IsValidAsync(token))
{
logger.LogError("The token request was rejected because the authorization code " +
"or refresh token '{Identifier}' was no longer valid.", identifier);

11
src/OpenIddict/OpenIddictProvider.Introspection.cs
View File

@ -55,7 +55,7 @@ namespace OpenIddict
}
// Retrieve the application details corresponding to the requested client_id.
var application = await applications.FindByClientIdAsync(context.ClientId, context.HttpContext.RequestAborted);
var application = await applications.FindByClientIdAsync(context.ClientId);
if (application == null)
{
logger.LogError("The introspection request was rejected because the client " +
@ -73,8 +73,7 @@ namespace OpenIddict
context.Request.SetProperty($"{OpenIddictConstants.Properties.Application}:{context.ClientId}", application);
// Reject the request if the application is not allowed to use the introspection endpoint.
if (!await applications.HasPermissionAsync(application,
OpenIddictConstants.Permissions.Endpoints.Introspection, context.HttpContext.RequestAborted))
if (!await applications.HasPermissionAsync(application, OpenIddictConstants.Permissions.Endpoints.Introspection))
{
logger.LogError("The introspection request was rejected because the application '{ClientId}' " +
"was not allowed to use the introspection endpoint.", context.ClientId);
@ -87,7 +86,7 @@ namespace OpenIddict
}
// Reject introspection requests sent by public applications.
if (await applications.IsPublicAsync(application, context.HttpContext.RequestAborted))
if (await applications.IsPublicAsync(application))
{
logger.LogError("The introspection request was rejected because the public application " +
"'{ClientId}' was not allowed to use this endpoint.", context.ClientId);
@ -100,7 +99,7 @@ namespace OpenIddict
}
// Validate the client credentials.
if (!await applications.ValidateClientSecretAsync(application, context.ClientSecret, context.HttpContext.RequestAborted))
if (!await applications.ValidateClientSecretAsync(application, context.ClientSecret))
{
logger.LogError("The introspection request was rejected because the confidential or hybrid application " +
"'{ClientId}' didn't specify valid client credentials.", context.ClientId);
@ -154,7 +153,7 @@ namespace OpenIddict
var token = context.Request.GetProperty<TToken>($"{OpenIddictConstants.Properties.Token}:{identifier}");
Debug.Assert(token != null, "The token shouldn't be null.");
if (!await tokens.IsValidAsync(token, context.HttpContext.RequestAborted))
if (!await tokens.IsValidAsync(token))
{
logger.LogInformation("The token '{Identifier}' was declared as inactive because it was revoked.", identifier);

11
src/OpenIddict/OpenIddictProvider.Revocation.cs
View File

@ -81,7 +81,7 @@ namespace OpenIddict
}
// Retrieve the application details corresponding to the requested client_id.
var application = await applications.FindByClientIdAsync(context.ClientId, context.HttpContext.RequestAborted);
var application = await applications.FindByClientIdAsync(context.ClientId);
if (application == null)
{
logger.LogError("The revocation request was rejected because the client " +
@ -99,8 +99,7 @@ namespace OpenIddict
context.Request.SetProperty($"{OpenIddictConstants.Properties.Application}:{context.ClientId}", application);
// Reject the request if the application is not allowed to use the revocation endpoint.
if (!await applications.HasPermissionAsync(application,
OpenIddictConstants.Permissions.Endpoints.Revocation, context.HttpContext.RequestAborted))
if (!await applications.HasPermissionAsync(application, OpenIddictConstants.Permissions.Endpoints.Revocation))
{
logger.LogError("The revocation request was rejected because the application '{ClientId}' " +
"was not allowed to use the revocation endpoint.", context.ClientId);
@ -113,7 +112,7 @@ namespace OpenIddict
}
// Reject revocation requests containing a client_secret if the application is a public client.
if (await applications.IsPublicAsync(application, context.HttpContext.RequestAborted))
if (await applications.IsPublicAsync(application))
{
if (!string.IsNullOrEmpty(context.ClientSecret))
{
@ -151,7 +150,7 @@ namespace OpenIddict
return;
}
if (!await applications.ValidateClientSecretAsync(application, context.ClientSecret, context.HttpContext.RequestAborted))
if (!await applications.ValidateClientSecretAsync(application, context.ClientSecret))
{
logger.LogError("The revocation request was rejected because the confidential or hybrid application " +
"'{ClientId}' didn't specify valid client credentials.", context.ClientId);
@ -208,7 +207,7 @@ namespace OpenIddict
var token = context.Request.GetProperty<TToken>($"{OpenIddictConstants.Properties.Token}:{identifier}");
Debug.Assert(token != null, "The token shouldn't be null.");
if (await tokens.IsRevokedAsync(token, context.HttpContext.RequestAborted))
if (await tokens.IsRevokedAsync(token))
{
logger.LogInformation("The token '{Identifier}' was not revoked because " +
"it was already marked as invalid.", identifier);

2
src/OpenIddict/OpenIddictProvider.Session.cs
View File

@ -115,7 +115,7 @@ namespace OpenIddict
return;
}
if (!await applications.ValidatePostLogoutRedirectUriAsync(context.PostLogoutRedirectUri, context.HttpContext.RequestAborted))
if (!await applications.ValidatePostLogoutRedirectUriAsync(context.PostLogoutRedirectUri))
{
logger.LogError("The logout request was rejected because the specified post_logout_redirect_uri " +
"was unknown: {PostLogoutRedirectUri}.", context.PostLogoutRedirectUri);

Write Preview
Loading…
Cancel
Save