italia / spid-cie-oidc-django

The SPID/CIE OIDC Federation SDK, written in Python
Apache License 2.0
22 stars 25 forks source link

Schema for authn_request ui_locales is not correct #303

Open matteo-s opened 6 months ago

matteo-s commented 6 months ago

ui_locales by spec is a space-separated list of identifiers, but in the schema is defined as List[].

When an RP passes a valid string, with one or more values in it, the schema validator complains that the parameter is invalid. This is caused by the update of the parameter in 806a4e3f321165f2759b8627ac27f8397ad1f9f8 in spid_cie_oidc/provider/schemas/authn_requests.py

    ui_locales: Optional[List[str]]

To resolve either switch back the definition (rolling back the commit) or modify the handling in the view to force processing the parameter as List.

in spid_cie_oidc/provider/views/authz_request_view.py

 def validate_authz(self, payload: dict):

        must_list = ("scope", "acr_values", "ui_locales")