search

cablelabs / lpwanserver

LPWAN Provisioning & Management Server
https://lpwanserver.com
Apache License 2.0
37 stars 11 forks source link

TTN Oauth Redirect URL #178

Closed rhythnic closed 5 years ago

rhythnic commented 6 years ago

locahost:3000 is hard-coded for the oauth redirect URL in networkProtocols/TheThingsNetwork.js. We need to make this configurable. I've never seen it done this way, where the server sends the redirect URL. Usually it's configured through the dashboard of the identity provider. I'm guessing that the server sending the callback URL serves the same security purpose.

Let's forget about supporting multiple possible browser clients, or anyway, make a specific oauth callback path a requirement of all browser clients. So the path can be hard coded, but the server needs to be aware of the domain/port that served the client assets.

It might be OK to get it from the client. I don't really see how it helps to provide the callback URL when requesting the token. A man-in-the-middle, who could intercept the code, would also have the redirect URL, since the code is part of the URL. The callback URL should be verified before the code is given.

rhythnic commented 5 years ago

I learned that the TTN oauth redirect uri is registered along with the TTN client, so being that it can't be anything else, I think it's acceptable to pass the redirect URI from the client to the server. If the lpwanserver is served on https, it shouldn't be a problem. I added the change, and I'll do a PR soon.