search

BoltAuth / Auth

Auth extension for Bolt
MIT License
16 stars 17 forks source link

[BUG] [Security Issue] you are leaking the OAuth2 client_secret #52

Open ppetermann opened 5 years ago

ppetermann commented 5 years ago

In: https://github.com/BoltAuth/Auth/blob/2cddfab096465b051f7b3bf984c3e64874afcf40/src/Oauth2/Client/ProviderManager.php#L167

the client_secret is put into the ProviderOptions, which is used here:

https://github.com/BoltAuth/Auth/blob/2cddfab096465b051f7b3bf984c3e64874afcf40/src/Oauth2/Handler/Remote.php#L184 https://github.com/BoltAuth/Auth/blob/2cddfab096465b051f7b3bf984c3e64874afcf40/src/Oauth2/Handler/Remote.php#L185 https://github.com/BoltAuth/Auth/blob/2cddfab096465b051f7b3bf984c3e64874afcf40/src/Oauth2/Handler/Remote.php#L186

to build the authorization Url, which ist send as a redirect to the users browser, thus exposing the client_secret.

the client_secret should only be used in the token exchange, thus when the server makes the request to the provider, and not during authorization when the browser of the user does.

This is NOT a flaw in Leagues client, this is due to too many options being included when forming the url in the aforementioned lines of code.

SvanteRichter commented 5 years ago

Hey,

Thanks for the report and digging into this. Also sorry for it being 3 days before I saw this, I'm looking for other maintainers for this repo. Do you have a fix for this ready? If so I'd be more than willing to merge it and tag a release ASAP. Otherwise I'll try to get time to fix this as soon as I can find time.

Thanks!

rossriley commented 5 years ago

@SahAssar I'll have a look at it if you've not had time yet.

SvanteRichter commented 5 years ago

@rossriley Thanks, that'd be great :)