search

jaredhanson / passport-oauth2

OAuth 2.0 authentication strategy for Passport and Node.js.
https://www.passportjs.org/packages/passport-oauth2/?utm_source=github&utm_medium=referral&utm_campaign=passport-oauth2&utm_content=about
MIT License
602 stars 343 forks source link

This client violates the RFC for openid #117

Open hcldan opened 4 years ago

hcldan commented 4 years ago

Greetings!

We recently got a support ticket from a customer who is using your passport oauth2 module. They are having an issue with client authentication. The issue does not occur when using other standards-compliant modules to do oauth2 flows.

We use https://github.com/panva/node-oidc-provider an OpenID certified project as our server. I believe the issue we are running into is this: https://github.com/panva/node-oidc-provider/issues/361

The problem is that the spec is not being followed in the passport-oauth2 module.
Could you look into this? Is this something you are willing to fix? This issue may be related: https://github.com/jaredhanson/passport-oauth2/issues/106

Thanks!

jaredhanson commented 4 years ago

Have you identified whether the issue is this package, or the underlying node-oauth package? The underlying package is responsible for serializing credentials, so it may be there.

Sent from my iPhone

On Oct 10, 2019, at 2:07 PM, Dan Dumont notifications@github.com wrote:

Greetings!

We recently got a support ticket from a customer who is using your passport oauth2 module. They are having an issue with client authentication. The issue does not occur when using other standards-compliant modules to do oauth2 flows.

We use https://github.com/panva/node-oidc-provider an OpenID certified project as our server. I believe the issue we are running into is this: panva/node-oidc-provider#361

The problem is that the spec is not being followed in the passport-oauth2 module. Could you look into this? Is this something you are willing to fix? This issue may be related: #106

Thanks!

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.

hcldan commented 4 years ago

I'll take a look

hcldan commented 4 years ago

Actually... taking a look at that project, you may want to consider moving away. Last commit was 2017. There are tons of open issues, and it appears to be abandoned.