According to https://tools.ietf.org/html/rfc6749#section-2.3.1 client… #534
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… identifier and secret MUST be x-www-form-urlencoded when doing client_secret_basic client authentication.
panva
reviewed
May 3, 2018
src/oic/utils/authn/client.py
Outdated
| @@ -108,7 +109,7 @@ def construct(self, cis, request_args=None, http_args=None, **kwargs): | |||
| if "headers" not in http_args: | |||
| http_args["headers"] = {} | |||
|
|
|||
| credentials = "{}:{}".format(user, passwd) | |||
| credentials = "{}:{}".format(quote_plus(user), quote_plus(passwd)) | |||
| authz = base64.urlsafe_b64encode(credentials.encode("utf-8")).decode( | |||
There was a problem hiding this comment.
To think of it, shouldn't content be just b64encoded instead of urlsafe_b64encoded?
There was a problem hiding this comment.
Hmm, you may well be right!
panva
reviewed
May 3, 2018
tests/test_client.py
Outdated
| assert http_args == {"headers": {"Authorization": "Basic {}".format( | ||
| base64.urlsafe_b64encode("A:boarding pass".encode("utf-8")).decode( | ||
| "utf-8"))}} | ||
| base64.urlsafe_b64encode(cred.encode("utf-8")).decode("utf-8"))}} |
There was a problem hiding this comment.
same, shouldn't basic auth use just b64encode?
panva
reviewed
May 3, 2018
tests/test_authn_user.py
Outdated
| credentials = "{}:{}".format(quote_plus(user), | ||
| quote_plus(passwd)) | ||
|
|
||
| authz = base64.urlsafe_b64encode(credentials.encode("utf-8")).decode( |
There was a problem hiding this comment.
same, shouldn't basic auth use just b64encode?
Codecov Report
@@ Coverage Diff @@
## master #534 +/- ##
==========================================
+ Coverage 59.54% 59.61% +0.07%
==========================================
Files 62 62
Lines 11237 11247 +10
Branches 1978 1981 +3
==========================================
+ Hits 6691 6705 +14
+ Misses 3992 3984 -8
- Partials 554 558 +4
Continue to review full report at Codecov.
|
|
Changelog entry is still missing, looks good otherwise. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
… identifier and secret MUST be x-www-form-urlencoded when doing client_secret_basic client authentication.
CHANGELOG.md.