e0ipso / e0ipso/simple_oauth_21

simple_oauth_server_metadata module exports absolute URLs for endpoints

Open
#21 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
4
Forks
3
PR merge metrics
No merged PRs in 30d

Description

When accessing the module settings page for the simple_oauth_server_metadata submodule at /admin/config/people/simple_oauth/oauth-21/server-metadata, the textfields for these endpoints:
* Client Registration Endpoint
* Token Revocation Endpoint
* Token Introspection Endpoint

will by default be 'Auto-detected from Simple OAuth module'. The auto-detection will put the full absolute URL of the site along with the relevant endpoint path e.g. /oauth/revoke. If you try and remove the hostname and just leave /oauth/revoke, saving the form throws a form error "The URL /oauth/revoke is not valid."

The issue I am raising is that if you accept the full absolute URL and save settings, then the exported Drupal config YAML will have the full absolute URL in the config export. Given that most of the time developers would be configuring locally and pushing changes through dev, test, and production environments, having the full absolute URL in the configs will be problematic. Instead the endpoints should be relative in the settings form and in the config export, and when said endpoints need to be accessed in a given environment, other parts of the code should prepend the given site's hostname to the configured relative endpoints.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.