eclipse-thingweb / eclipse-thingweb/node-wot

OAuth2 "client" security not working correctly

Open
#890 5 comments 0 reactions 1 assignee Claimed by @relu91 View on GitHub
binding-http security
Dominant language
TypeScript
Stars
192
Forks
100
Avg merge
3d 2h
Merged PRs (30d)
6

Description

Hi,

I'm trying to use OAuth2 with "client_credentials" grant and have found one bug:

Here is my configuration:

**Thing description**
```
"id": "urn:1234",
"securityDefinitions": {
"oauth2_sc": {
"scheme": "oauth2",
"flow": "client",
"authorization": "https://***/protocol/openid-connect/auth",
"token": "https://***/protocol/openid-connect/token",
"scopes": [
"email",
"profile"
]
}
},
"security": "oauth2_sc",
```

**Consumer**
```
servient.addClientFactory(new HttpClientFactory(undefined));
const credentials: Record = {
"urn:1234":
{
clientId: "xyz",
clientSecret: "secret"
}
};
servient.addCredentials(credentials);
```

There is a bug here https://github.com/eclipse/thingweb.node-wot/blob/22f7b2a4e0a1fdc1c8954b6c59ffd80bc4c2fcae/packages/binding-http/src/oauth-manager.ts#L53
If the `access_token` is too long and split into two entries in the array `toString()` will add a comma to the `access_token`.
This could be fixed by replacing `toString()` with `join('')`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.