search

FriendsOfFlarum / oauth

Allow users to log in with GitHub, Twitter, Facebook, and more!
https://discuss.flarum.org/d/25182
MIT License
42 stars 14 forks source link

Potential Method Bug: State Token potentially lost when new a Oauth window opens on iOS mobile browsers #16

Open michaelangeloio opened 3 years ago

michaelangeloio commented 3 years ago

Hi FoF! Hope everyone's doing well!

While testing FoF Oauth on mobile, specifically iOS 14, I believe there is an error. Here's a link to a video demonstrating what happens.

I'm thinking it may be an exception that's raised when Flarum tries to compare tokens because the token is lost during a new window launch. Could be wrong though!

Whoops! There was an error..zip

Thank you :)

Michael Angelo Rivera

michaelangeloio commented 3 years ago

You may have to copy and paste those URLs to your browser!

clarkwinkelmann commented 3 years ago

I'm unable to view the video. Can you enable public access?

It's probably not a good idea to share a Facebook access token here. Though it will probably have expired by the time anyone can test anything.

This kind of error can happen if your URL in config.php is invalid and that a redirect is followed at some point.

It would be very odd if it doesn't happen on all browsers but only mobile.

michaelangeloio commented 3 years ago

@clarkwinkelmann should be expired soon (I think, lol). I've edited the URL of the video, can you test if it works?

Also, the login works (for other users as well) for all devices except mobile (iOS specifically). You can also test the same error if you have iPhone at https://sheetscience.io

clarkwinkelmann commented 3 years ago

Unfortunately I don't have any iOS device, and I don't see any obvious issue just by looking at the video.

Let's wait for another FoF member to chime in. Not sure if anyone's got Apple products to test.

katosdev commented 3 years ago

@michaelangrivera i have an iPhone 12 pro on iOS 14.2.1 To assist me in testing this and confirming, please can you:

Kind regards Phil

michaelangeloio commented 3 years ago

@katosdev hi! My phone is iPhone 11 running on 14.2.1, the other user I had test it was on an iPhone 12 Pro using 14.2.1 when testing. I can have others with other models test as well.

The same error is persistent across three browsers on the iPhone- Safari, Chrome, Firefox. I've tested all 3.

X3I8I6T3 is one I have generated for you. BOBB0D1O is another I have generated. Would you like one that "activates user" as well?

Thank you,

Michael Angelo Rivera

katosdev commented 3 years ago

Issue confirmed on your own site:

https://sheetscience.io/auth/google?state=0dcdf9aee655ade6fa75dab94d4079e0&code=4/0AY0e-g6mDeMEmtoRE44MaQwc3i9v34B_GKL0YhHij0Cu1kFaRqcBWLtbwAfJxLgVd9nIEw&scope=email%20profile%20openid%20https://www.googleapis.com/auth/userinfo.email%20https://www.googleapis.com/auth/userinfo.profile&authuser=1&hd=creatorswave.com&prompt=consent

This looks like an invalid callback URL is at fault to be honest (I tried using google by the way).

please can you confirm what your callback URL is set to?

katosdev commented 3 years ago

Issue not present when PWA extension is disabled, suspect that the CSRF token is not being passed through properly for the OAuth.

Further testing is required on my local host but I may have a potential fix. This appears to be a common OAuth issue, looking at other providers.

michaelangeloio commented 3 years ago

@katosdev Awesome! Just let me know if you need any more assistance from my end!

michaelangeloio commented 3 years ago

@katosdev Any ideas or workarounds that you're thinking of?

DavideIadeluca commented 1 month ago

@michaelangeloio Is the issue you were describing still happening on the latest version of fof/oauth ?