search

ccpgames / sso-issues

Please file issues with the CCP SSO (login.eveonline.com) here.
17 stars 1 forks source link

Fail Before Login Attempt if Invalid Client ID/Callback URL/Scopes are Supplied #26

Open PrometheusSatyen opened 6 years ago

PrometheusSatyen commented 6 years ago

Feature / Modification Request

Description

Currently if you visit an invalid SSO url such as: https://login.eveonline.com/oauth/authorize?response_type=code&redirect_uri=eveauth-cerebral%3A%2F%2Fcallback&client_id=3e601&scope=esi-location.read_location.v1&state=login

If no character is logged in, the login screen will load despite the totally invalid client id. Only after logging in will an error then be displayed (as a JSON body returned with an error property)

I would like this altered so that the error is received even if no user is logged in.

Use case

My desktop app has to prompt for users to generate and enter a client ID/secret so that I don't have to bake the secret into the binary. It would be helpful if I could easily test the entered client ID by firing off a GET request and seeing what comes back.

DaneelTrevize commented 6 years ago

Can you not instead first use the client ID to test sending a faked code value to /oauth/token? Or does that not return anything about invalid client ID?
If it does detail bad client ID & secret values before considering the code value, you can use this test before you redirect users to SSO for the same app.