e0ipso / e0ipso/simple_oauth_21
simple_oauth_server_metadata module exports absolute URLs for endpoints
- Dominant language
- PHP
- Stars
- 4
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
When accessing the module settings page for the simple_oauth_server_metadata submodule at /admin/config/people/simple_oauth/oauth-21/server-metadata, the textfields for these endpoints:
* Client Registration Endpoint
* Token Revocation Endpoint
* Token Introspection Endpoint
will by default be 'Auto-detected from Simple OAuth module'. The auto-detection will put the full absolute URL of the site along with the relevant endpoint path e.g. /oauth/revoke. If you try and remove the hostname and just leave /oauth/revoke, saving the form throws a form error "The URL /oauth/revoke is not valid."
The issue I am raising is that if you accept the full absolute URL and save settings, then the exported Drupal config YAML will have the full absolute URL in the config export. Given that most of the time developers would be configuring locally and pushing changes through dev, test, and production environments, having the full absolute URL in the configs will be problematic. Instead the endpoints should be relative in the settings form and in the config export, and when said endpoints need to be accessed in a given environment, other parts of the code should prepend the given site's hostname to the configured relative endpoints.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.