Skip to content

Commit

Permalink
fix: encode client_secret_basic - _ . ! ~ * ' ( ) characters
Browse files Browse the repository at this point in the history
Because encodeURIComponent() encodes everything except alphanumericals
and `- _ . ! ~ * ' ( )` these need to be encoded explicitly similar to
how the resulting `%20' is replaced with '+'

This is as per RFC6749 Section 2.3.1 and Appendix B
  • Loading branch information
panva committed Jan 5, 2024
1 parent 9d3cfb8 commit 5a2ea80
Show file tree
Hide file tree
Showing 2 changed files with 21 additions and 2 deletions.
21 changes: 20 additions & 1 deletion lib/helpers/client.js
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,26 @@ const request = require('./request');
const { keystores } = require('./weak_cache');
const merge = require('./merge');

const formUrlEncode = (value) => encodeURIComponent(value).replace(/%20/g, '+');
function formUrlEncode(token) {
return encodeURIComponent(token).replace(/(?:[-_.!~*'()]|%20)/g, (substring) => {
switch (substring) {
case '-':
case '_':
case '.':
case '!':
case '~':
case '*':
case "'":
case '(':
case ')':
return `%${substring.charCodeAt(0).toString(16).toUpperCase()}`;
case '%20':
return '+';
default:
throw new Error();
}
});
}

async function clientAssertion(endpoint, payload) {
let alg = this[`${endpoint}_endpoint_auth_signing_alg`];
Expand Down
2 changes: 1 addition & 1 deletion test/client/client_instance.test.js
Original file line number Diff line number Diff line change
Expand Up @@ -2274,7 +2274,7 @@ describe('Client', () => {
expect(await clientInternal.authFor.call(client, 'token')).to.eql({
headers: {
Authorization:
'Basic YW4lM0FpZGVudGlmaWVyOnNvbWUrc2VjdXJlKyUyNitub24tc3RhbmRhcmQrc2VjcmV0',
'Basic YW4lM0FpZGVudGlmaWVyOnNvbWUrc2VjdXJlKyUyNitub24lMkRzdGFuZGFyZCtzZWNyZXQ=',
},
});
});
Expand Down

0 comments on commit 5a2ea80

Please sign in to comment.