Send token revocation request as POST with form-encoded body - #624
Draft
rootkiller6788 wants to merge 1 commit into
Draft
Send token revocation request as POST with form-encoded body#624rootkiller6788 wants to merge 1 commit into
rootkiller6788 wants to merge 1 commit into
Conversation
The disconnect flow built a revoke URL with the token in the query string and fetched it with the default GET method. Google's OAuth2 token revocation endpoint (and RFC 7009 section 2.1) requires a POST request carrying the token in a form-encoded body. Generalize startFetchURL: to accept an HTTP method and body, use POST with a form-encoded body for revocation, and update the disconnect tests to assert the method and body instead of the query string.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
disconnectWithCompletion:built a revocation URL with the token in the query string (/o/oauth2/revoke?token=...) and fetched it viastartFetchURL:, which creates anNSMutableURLRequestwithout settingHTTPMethod, so the request went out asGET.Google's OAuth2 token revocation docs and RFC 7009 section 2.1 both specify a
POSTrequest carrying the token in a form-encoded body.Fixes #621.
Changes
kHTTPMethodPostandkContentTypeFormURLEncodedconstants.startFetchURL:to accept an HTTP method and optional body; the userinfo fetch keeps usingGETwith no body.POSTwith the token (and logging parameters) in anapplication/x-www-form-urlencodedbody, reusing the existingNSURLComponents/GIDPercentEncodePlusInQueryencoding so a literal+in a token survives form decoding.GIDFakeFetcherto expose the request HTTP method and body.POSTand the token/logging parameters are in the decoded body rather than the query string.Testing
Updated the existing disconnect unit tests in
GIDSignInTest.mto cover the new POST + form body behavior, including the token-percent-encoding cases (reserved characters,+, and space).