Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade/allow oauth2 to be 2.0 #67

Closed
PragTob opened this issue Aug 15, 2019 · 2 comments · Fixed by #68
Closed

Upgrade/allow oauth2 to be 2.0 #67

PragTob opened this issue Aug 15, 2019 · 2 comments · Fixed by #68

Comments

@PragTob
Copy link
Contributor

PragTob commented Aug 15, 2019

oauth2 was semi recently upgraded to 2.0 with a fix that seems important and relevant. Would be nice to also include that in a future release.

Also, thanks for the great library! 👋 🎉
@taj
Copy link
Member

taj commented Aug 20, 2019 •
edited
Loading

hello @PragTob we will look into it! :) but you are welcome to contribute with PRs as well if you want!

@PragTob
Copy link
Contributor Author

PragTob commented Aug 21, 2019 •
edited
Loading

@tajchumber I can happily do a PR allowing OAuth 2.0 just not to sure about the details/specifics as I'm unsure if the "possibly backwards compatible" part applies to this lib or not.

The big PR seems to be this ueberauth/oauth2#131 which fixes ueberauth/oauth2#128 which is a security related issue.

edit: added a small PR not sure what kind of testing one would need t do for this though #68

PragTob added a commit to PragTob/ueberauth_google that referenced this issue Aug 21, 2019
@PragTob
Allow newest oauth2 client with security fixes
1456715 
oauth2 has a recent possibly backwards incompatible release that
makes sure the spec is followed and authorization headers are
respected (https://github.com/scrogson/oauth2/blob/master/CHANGELOG.md#v200-2019-07-15)
This fixed ueberauth/oauth2#128 hence I think it's important to
include.
Decided to not require 2.x as that might conflict too hard
with other libraries. Also decided to allow minor version bumps
as @scrogson seems to be good about semver <3
As ueberauth#66 isn't merged yet I'd like it if this could get in with the
release.

fixes ueberauth#67
@PragTob PragTob mentioned this issue Aug 21, 2019
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Allow newest oauth2 client with security fixes PragTob/ueberauth_google
2 participants
@PragTob @taj