Kong / Kong/insomnia

Rendering purpose is not set during oauth2 token refresh for plugins

Open
#4,778 2 comments 0 reactions 0 assignees View on GitHub
B-bug S-verified
Dominant language
TypeScript
Stars
40k
Forks
2.4k
Avg merge
2d 13h
Merged PRs (30d)
61

Description

### Expected Behavior

The plugin receives the rendering purpose even during oauth2 token refresh and is able to render secrets accordingly

```
{"type":"oauth2","grantType":"client_credentials","accessTokenUrl":"https://example.edu","clientId":"","credentialsInBody":"true","clientSecret":"{% keepass 'keepassxc', '', '', 'https://example.edu', 'password' %}"}
```

is rendered to

```
{"type":"oauth2","grantType":"client_credentials","accessTokenUrl":"https://example.edu","clientId":"","credentialsInBody":"true","clientSecret":"mypass"}
```

### Actual Behavior

The client secret in oauth2 token refresh when using a plugin is rendered wrong, as it is rendered without the `RenderPurpose` set to `send`. A security aware plugin that only wants to render an actual secret when going over the wire, can therefore not be used for client secret.

```
{"type":"oauth2","grantType":"client_credentials","accessTokenUrl":"https://example.edu","clientId":"","credentialsInBody":"true","clientSecret":"{% keepass 'keepassxc', '', '', 'https://example.edu', 'password' %}"}
```

is rendered to

```
{"type":"oauth2","grantType":"client_credentials","accessTokenUrl":"https://example.edu","clientId":"","credentialsInBody":"true","clientSecret":"KeepassXC - password of https://example.edu"}
```

### Reproduction Steps

* Install plugin insomnia-plugin-keepass (this is not a plugin bug)
* In Oauth2 use Keepass tag in client secret

### Is there an existing issue for this?

- [X] I have searched the [issue tracker](https://www.github.com/Kong/insomnia/issues) for this problem.

### Additional Information

Possible quickfix solution is to add optional parameter for RenderPurpose to `use-nunjucks.ts` and `o-auth-2-auth.tsx`

https://github.com/dansailer/insomnia/pull/1/files

### Insomnia Version

2022.3.0

### What operating system are you using?

macOS

### Operating System Version

Windows 10 and macOS 12.3.1

### Installation method

homebrew (MacOS), Installer exe (Windows)

### Last Known Working Insomnia version

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with use-nunjucks.ts and o-auth-2-auth.tsx, the entry points named in the issue, and trace how the OAuth2 client secret is rendered during token refresh. Confirm that the plugin receives RenderPurpose.send and that the example Keepass tag produces the actual secret when sent over the wire.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.