fair-research / native-login

Provides Native App login and token storage for multiple providers
Apache License 2.0
3 stars 2 forks source link

Fix leaky tokens, add better verification, fix default_scopes bug #39

Closed NickolausDS closed 5 years ago

NickolausDS commented 5 years ago

This adds a few fixes, with the main fix for #37.

Additionally, this adds better support for verifying token groups. In several places within the codebase, 'token_groups' are assumed to have various properties without actually checking for them, such as 'expires_at_seconds' and 'access_token' being properties that exist within a token dictionary. save_tokens() relies on this quite a bit, but it's good to have this generally for loading tokens too. The verification is fairly loose, and allows for some variance. See below for more info.

Leaky tokens are fixed by revoking tokens that are slated to be overwritten.

Added one additional fix where login() wouldn't respect default scopes set in NativeClient().