EUDAT-B2SHARE / b2share

B2SHARE software for the EUDAT CDI services.
https://b2share.eudat.eu
GNU General Public License v2.0
35 stars 32 forks source link

Bug: Special chars in OAuth2 secret #1868

Closed JohannesLares closed 2 years ago

JohannesLares commented 2 years ago

B2SHARE's OAuth2 client secret currently can't contain %-signs.

This worked up to around 11.12.2019, but failed in production unexpectedly. Most likely changes in B2ACCESS' Unity version has brought the hidden problem up.

Problem seems to be that the body/payload of the request to B2ACCESS is not being URL encoded. This is a requirement per RFC 6749 section 2.3.1. Appendix B also shows that %-sign is reserved for escaping purposes. See Wikipedia for human readable details.