FormidableLabs / FormidableLabs/react-native-app-auth

Propagate HTTP status code on error instances thrown by authorize and refresh calls

未关闭
#855 1 条评论 2 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Java
星标
2.3k
派生
473
PR 合并指标
30 天内没有已合并 PR

描述

## Issue
It seems that the error object thrown by `authorize` and `refresh` calls on failures do not include the HTTP status code for errors returned by the IdP.
In case of iOS, the status code could somehow still be retrieved if you do `error?.userInfo?.NSUnderlyingError?.code` (not sure if that's recommended) but for android there's no trace of HTTP response in the object.

See the error object structure for Android and iOS for failed `refresh` call.

##### Android error
```json
{
"code": "invalid_grant",
"column": 51,
"line": 1579,
"message": "The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.",
"nativeStackAndroid": [
{
"class": "net.openid.appauth.AuthorizationService$TokenRequestTask",
"file": "AuthorizationService.java",
"lineNumber": 659,
"methodName": "onPostExecute"
},
{
"class": "net.openid.appauth.AuthorizationService$TokenRequestTask",
"file": "AuthorizationService.java",
"lineNumber": 564,
"methodName": "onPostExecute"
},
{
"class": "android.os.AsyncTask",
"file": "AsyncTask.java",
"lineNumber": 771,
"methodName": "finish"
},
{
"class": "android.os.AsyncTask",
"file": "AsyncTask.java",
"lineNumber": 199,
"methodName": "access$900"
},
{
"class": "android.os.AsyncTask$InternalHandler",
"file": "AsyncTask.java",
"lineNumber": 788,
"methodName": "handleMessage"
},
{
"class": "android.os.Handler",
"file": "Handler.java",
"lineNumber": 106,
"methodName": "dispatchMessage"
},
{
"class": "android.os.Looper",
"file": "Looper.java",
"lineNumber": 223,
"methodName": "loop"
},
{
"class": "android.app.ActivityThread",
"file": "ActivityThread.java",
"lineNumber": 7656,
"methodName": "main"
},
{
"class": "java.lang.reflect.Method",
"file": "Method.java",
"lineNumber": -2,
"methodName": "invoke"
},
{
"class": "com.android.internal.os.RuntimeInit$MethodAndArgsCaller",
"file": "RuntimeInit.java",
"lineNumber": 592,
"methodName": "run"
},
{
"class": "com.android.internal.os.ZygoteInit",
"file": "ZygoteInit.java",
"lineNumber": 947,
"methodName": "main"
}
],
"userInfo": null
}
```
##### iOS error
```
{
code: 'invalid_grant',
domain: 'org.openid.appauth.oauth_token',
message:
'The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.',
nativeStackIOS: [Array],
userInfo: {
NSLocalizedDescription:
'invalid_grant: The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.',
NSUnderlyingError: {
code: '400',
domain: 'org.openid.appauth.remote-http',
message: 'underlying error',
nativeStackIOS: [Array],
userInfo: [Object],
},
OIDOAuthErrorResponseErrorKey: {
error: 'invalid_grant',
error_description:
'The provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.',
},
},
}
```

**Note:** for iOS, it is possible to get the code with `error?.userInfo?.NSUnderlyingError?.code` but it's platform specific.

---

## Proposal
I'd propose introducing an additional parameter `status` or `statusCode` in the error object giving us a standard way to get the HTTP status code returned by the IdP.

Let me know if you have a better idea. We can do a PR, if this is agreeable.

## Environment

* **Your Identity Provider**: `e.g. Ory Hydra`
* **Platform that you're experiencing the issue on**: `both`

贡献指南

打开贡献指南

调研方向

首先跟踪 authorize 和 refresh 调用如何通过 Android 和 iOS bridge 传播失败,并比较 issue 中显示的错误对象。完成的标准是两个平台都通过一个标准化的错误属性公开 IdP 的 HTTP 状态码,而不是通过平台特定的 userInfo 数据公开。

由索引模型根据 Issue 内容生成。

评估

技术栈
java, react-native
领域
authentication, mobile
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。