inveniosoftware / invenio-oauthclient

Invenio module that provides OAuth web authorization support.
https://invenio-oauthclient.readthedocs.io
MIT License
6 stars 74 forks source link

client: handles OAuthException #125

Closed pamfilos closed 7 years ago

pamfilos commented 7 years ago

When you login with CERN OAuth and you go 'Back' it throughs an Internal Server Error

[2017-03-28 14:16:22 +0200] [13916] [ERROR] Error handling request /app/oauth/authorized/cern/?code=d73e90f281524c23970ee1a88987047a97999c979bcc41908e65d5fe229551e8&state=eyJhbGciOiJIUzI1NiIsImV4cCI6MTQ5MDcwMzY3MiwiaWF0IjoxNDkwNzAzMzcyfQ.eyJhcHAiOiJjZXJuIiwic2lkIjoiZDU4ODRmYjM0NDIxNWRiMjUwN2ViYzg3ZDNlZTFiZThiYjlhNzY0MDgyOTliY2M4ZThiYzIwOTM2ZGM5MTQzNTNiMDkzYjQ4Mjc3NjdiMzM4MzkyYzM1NDQxMTczNjY3MDNjYTc1ZmMyYzU4NjIzYzE2NmI0YjQ3ZGRkYTkwODAiLCJuZXh0IjoiLyJ9.jL4lLM5AFT2HQigFtIPuV1-1sOQ1RvqY4FSc_HvChYw
Traceback (most recent call last):
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/gunicorn/workers/sync.py", line 135, in handle
    self.handle_request(listener, req, client, addr)
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/gunicorn/workers/sync.py", line 176, in handle_request
    respiter = self.wsgi(environ, resp.start_response)
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/flask/app.py", line 1994, in __call__
    return self.wsgi_app(environ, start_response)
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/werkzeug/wsgi.py", line 659, in __call__
    return app(environ, start_response)
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/flask/app.py", line 1994, in __call__
    return self.wsgi_app(environ, start_response)
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/flask/app.py", line 1985, in wsgi_app
    response = self.handle_exception(e)
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/flask/app.py", line 1540, in handle_exception
    reraise(exc_type, exc_value, tb)
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/flask/app.py", line 1982, in wsgi_app
    response = self.full_dispatch_request()
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/flask/app.py", line 1614, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/flask/app.py", line 1517, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/flask/app.py", line 1612, in full_dispatch_request
    rv = self.dispatch_request()
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/flask/app.py", line 1598, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File "/Users/pamfilos/.envs/cap/src/invenio-oauthclient/invenio_oauthclient/views/client.py", line 129, in authorized
    return current_oauthclient.handlers[remote_app]()
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/flask_oauthlib/client.py", line 698, in decorated
    data = self.authorized_response()
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/flask_oauthlib/client.py", line 677, in authorized_response
    data = self.handle_oauth2_response()
  File "/Users/pamfilos/.envs/cap/lib/python2.7/site-packages/flask_oauthlib/client.py", line 664, in handle_oauth2_response
    type='invalid_response', data=data
OAuthException: Invalid response from cern

catching the exception and redirecting to homepage fixes the issues

pamfilos commented 7 years ago

@lnielsen Can't catch it from here https://github.com/inveniosoftware/invenio-oauthclient/blob/master/invenio_oauthclient/handlers.py#L226

lnielsen commented 7 years ago

The error seems to be generated by Flask-Oauthlib

Can you put a breakpoint there and extract the request.header, request.data, request.code and paste it here. I'm interested in what is actually in the response from the remote side and why it is considered invalid.

pamfilos commented 7 years ago

So the issue when you go 'Back' exists because Flask-oauthlib needs the redirect_url (here), which doesn't exist as it is popped from here and it is None at that point.

When the redirect_url is missing CERN Oauth returns an {"error": "invalid_grant"} which can't be caught from oauth_error_handler

Also, @lnielsen @jirikuncar, how does this thing work for the Github contrib. Does it ever go here?