eclipse-thingweb / eclipse-thingweb/node-wot
OAuth2 "client" security not working correctly
- Dominant language
- TypeScript
- Stars
- 192
- Forks
- 100
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 6
Description
Hi,
I'm trying to use OAuth2 with "client_credentials" grant and have found one bug:
Here is my configuration:
**Thing description**
```
"id": "urn:1234",
"securityDefinitions": {
"oauth2_sc": {
"scheme": "oauth2",
"flow": "client",
"authorization": "https://***/protocol/openid-connect/auth",
"token": "https://***/protocol/openid-connect/token",
"scopes": [
"email",
"profile"
]
}
},
"security": "oauth2_sc",
```
**Consumer**
```
servient.addClientFactory(new HttpClientFactory(undefined));
const credentials: Record = {
"urn:1234":
{
clientId: "xyz",
clientSecret: "secret"
}
};
servient.addCredentials(credentials);
```
There is a bug here https://github.com/eclipse/thingweb.node-wot/blob/22f7b2a4e0a1fdc1c8954b6c59ffd80bc4c2fcae/packages/binding-http/src/oauth-manager.ts#L53
If the `access_token` is too long and split into two entries in the array `toString()` will add a comma to the `access_token`.
This could be fixed by replacing `toString()` with `join('')`.
Contributor guide
Assessment
This issue has not been assessed yet.