1

I've implemented my own classes for handling authorization via OAuth to GitHub using Faraday in Ruby. I've verified that under the following conditions:

  • Not logged into GitHub
  • No token exists for the app

that a request for authorization via GET to "/login/oauth/authorize" with a random state variable:

  • Redirects to the GitHub login page
  • Redirects to the Authorize Application page after login
  • Executes callback to my app with temporary code after authorizing
  • Responds with access_token when I POST to "/login/oauth/access_token" with temporary code

The problem I have is when I alter the first condition, I'm not already logged into GitHub. The same GET request is sent to GitHub, I see the correct URL with the right parameters. I then see what appears to be the correct redirect by GitHub with a return_to parameter, but it quickly just redirects again back to the GitHub home page.

I'm hoping it's something easy like forgetting a header parameter or something, and someone might spot the problem right away. Anyway, any help is appreciated...

Code to setup Faraday connection:

def connection
  @connection ||= Faraday.new(url: 'https://github.com') do |faraday|
    faraday.request  :url_encoded
    faraday.response :logger
    faraday.adapter  Faraday.default_adapter
  end
end

Code to send authorization request:

def request_authorization(client_id, redirect_uri, redirect_id, scope, expected_state)
  response = connection.get '/login/oauth/authorize', {
    client_id: client_id,
    redirect_uri: "#{redirect_uri}?id=#{redirect_id}",
    scope: scope,
    state: expected_state
  }

  if response.status == 302
    response.headers[:location]
  else
    nil
  end
end

I didn't show the code, but my controller does a redirect to the URL reply from request_authorization(). Again, I definitely see the redirect from my controller in both cases, but the second case seems to encounter something GitHub didn't like in the redirected request. I assume it then redirects to the home page and never replies to my app because of this unknown problem in my original request.

Thanks, David

4

1 回答 1

1

来自 GitHub 的 Ivan 在找到我的问题的答案方面提供了很大帮助。我曾假设问题出在使用 Faraday 或 OAuth 的一些细节上，但事实证明问题是一个被证明是错误的基本假设。希望这将有助于其他遇到类似误解的人。

我曾假设我的应用程序的用户想要连接到 GitHub（或其他 OAuth 服务）会向我的应用程序发出类似“连接”请求。然后，我的应用程序将向 GitHub 生成 OAuth 授权请求，处理任何重定向，并最终将 Authorize App 页面呈现给用户以供接受。

原来我只需要将“连接”请求作为一个链接，直接向 GitHub 发出授权请求。然后我的应用程序只需要担心处理回调，它已经这样做了。现在更容易并且适用于所有情况。

结果是错误的方法在未登录时起作用，因为它是简单的情况。登录时失败，因为我没有处理浏览器通常会提供的会话状态。

对 OAuth RFC 的更仔细阅读消除了我对用户代理和客户端处理请求和响应的位置的困惑。

于 2014-04-20T01:47:17.807 回答