search

akirk / enable-mastodon-apps

Allow accessing your WordPress blog with Mastodon clients
https://wordpress.org/plugins/enable-mastodon-apps
GNU General Public License v2.0
35 stars 6 forks source link

OAuth2 handler inserts errors into unrelated API call responses #145

Closed avdi closed 3 months ago

avdi commented 4 months ago

In debugging an issue with access to FluentCRM on avdi.codes, we tracked down the insertion of a spurious error into FluentCRM API responses to the Oauth2 module inside this plugin. Example:

image

This was breaking external FluentCRM integrations.

Is it possible to ratchet down the scope of requests this OAuth2 code intercepts to only Mastodon emulation paths?

akirk commented 4 months ago

Thanks for letting me know, sorry about that! Of course, I thought we already did so. Was it only on the v2/tags point?

avdi commented 4 months ago

Thanks for letting me know, sorry about that! Of course, I thought we already did so. Was it only on the v2/tags point?

FWIW I noticed just as I posted this that you just released a big update which my site had not yet updated at the time we did the debugging, so I can't confirm whether it's still an issue.

avdi commented 4 months ago

And I don't know how widespread the insertion is - I honestly wish I could spend more time testing but realistically it's going to be pretty back-burnered 😔 Thank you so much for the prompt response!

akirk commented 4 months ago

It is indeed something that was a problem prior to the release. I'll try to reproduce it with the old version and try it with the new one to see if it fixed it.

akirk commented 3 months ago

I confirmed that in 0.6.6, we were returning a {"error":"invalid_request","error_description":"Malformed auth header"} for HTTP Basic authentication, this is no longer the case in 0.9.0, so closing this. We'll reopen it if we get more evidence that this is still a problem in the current version. Thanks for the report!