panva / oauth4webapi

Low-Level OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
MIT License
597 stars 54 forks source link

fix: Validate 'expires_in' as a convertible number #77

Closed kwonth211 closed 1 year ago

kwonth211 commented 1 year ago

Summary This PR aims to enhance the flexibility of the processGenericAccessTokenResponse function by allowing the expires_in field to be a string that can be converted to a positive number.

Background In most cases, the OAuth 2.0 specification suggests that the expires_in field should be a numeric value. However, some OAuth providers deviate from this and send expires_in as a string. This creates compatibility issues when integrating with such services.

Changes The proposed change is a minimal alteration to the existing conditional check for expires_in. It now uses Number and isNaN to validate that expires_in can be converted to a positive number, whether it comes as a string or a number.

Benefits Enhances compatibility with OAuth providers that send expires_in as a string. Maintains the original check for expires_in being a positive number. Provides a more flexible and forgiving user experience.

Testing The change is minimal and does not introduce new dependencies or require new tests. Existing tests should suffice to validate this change.

Thank you

panva commented 1 year ago

There's already been PRs/issues open for this. expires_in in JSON responses is defined as a number, please reach out to your provider to get a fix on their end instead, or workaround the provider issue by instantiating a Response object with the original Response properties and the body type fixed.

kwonth211 commented 1 year ago

Thank you for the quick response and clarification. I'll look into working around the issue as suggested.