search

mcueto / djangorestframework-auth0

Library to simply use Auth0 token authentication in DRF within djangorestframework-jwt
MIT License
91 stars 19 forks source link

Client Secret is always base64 decoded but Auth0 client secrets are no longer base64 encoded. #16

Closed mwisner closed 7 years ago

mwisner commented 7 years ago

In the auth0 dashboard, client secrets are no longer being provided as base64 encoded strings.

There is a long discussion on the topic here: https://auth0.com/forum/t/client-secret-stored-without-base64-encoding/4338

However this package assumes the client_secret provided is always base64 encoded. This is slightly confusing to the developer and now requires an additional step of manually encoding the client secret prior to using it.

https://github.com/mcueto/djangorestframework-auth0/blob/master/rest_framework_auth0/settings.py#L28

Maybe we should make it configureable? Like a "CLIENT_SECRET_BASE64_ENCODED" setting perhaps? I am attempting to work on a fix but am currently having some personal challenges with developing the python package along side my primary application.

mcueto commented 7 years ago

Hi @mwisner! Don't worry, this weekend it will be fixed! (only tell me if you can't and i'll do it) 👍

Thanks for the heads up and for use this package!

Nice weekend

mcueto commented 7 years ago

Done! i'll update the sample package too!

Nice week for everyone and good night

mwisner commented 7 years ago

Thank you so much for fixing this! I really appreciate it. This package is super helpful.