jazzband / django-oauth-toolkit

OAuth2 goodies for the Djangonauts!
https://django-oauth-toolkit.readthedocs.io
Other
3.13k stars 792 forks source link

Unable to parse query string #1326

Closed codewriter3000 closed 12 months ago

codewriter3000 commented 1 year ago

Describe the bug

When I try to authorize, I get an error that says "Error; invalid request, unable to parse query string" To Reproduce

  1. Register an application as such: image
  2. Create a code_challenge as such:
    
    import random
    import string
    import base64
    import hashlib

code_verifier = ''.join(random.choice(string.asciiuppercase + string.digits) for in range(random.randint(43, 128))) code_verifier = base64.urlsafe_b64encode(code_verifier.encode('utf-8'))

code_challenge = hashlib.sha256(code_verifier).digest() code_challenge = base64.urlsafe_b64encode(code_challenge).decode('utf-8').replace('=', '')

print(fr'code verifier: {code_verifier}') print(fr'code challenger: {code_challenge}')


3. Go to: http://127.0.0.1:8000/o/authorize/?response_type-code&code_challenge=YO1xUfYUKR6PCM5m3r-IjQWJKbhQ8YgMls8gigtnVxc&code_challenge_method=5256&client_id=2edYoWkN7DBj6uREFbvjnbJLrN3Hzr64G7dxH0wL&redirect_uri=http://127.0.0.1:8000/noexist/callback and set the proper parameters.
**Expected behavior**
<!-- A clear and concise description of what you expected to happen. -->
I'm expecting to not see an error.
**Version**
<!-- Version of django-oauth-toolkit -->
2.3.0
<!-- Have you tested with the latest version and/or master branch? -->
<!-- Replace '[ ]' with '[x]' to indicate that. -->
- [X] I have tested with the latest published release and it's still a problem.
- [ ] I have tested with the master branch and it's still a problem.

**Additional context**
<!-- Add any other context about the problem here. -->
dopry commented 12 months ago

It looks like response_type-code should be response_type=code and the redirect_uri should be url encoded. please re-open if that doesn't resolve your isssue.

codewriter3000 commented 12 months ago

The error is now Mismatching redirect URI