pyeve / flask-sentinel

OAuth2 Server bundled as a Flask extension
Other
160 stars 43 forks source link

v0.0.7 'save_token' is not handling 'access_token' typecasting according to how redis wants it #37

Closed sillydan1 closed 3 years ago

sillydan1 commented 3 years ago

Whenever I try to perform an /oauth/token request, I get a 500 error (see below). I believe it is caused when saving the access token to the redis cache in data.py:161, where access_token is interpreted as an ObjectId which redis does not like. Could a simple string-cast fix this? Or maybe even casting it to a byte-array?

I tried to downgrade to v0.0.6, but it is using some super ancient version of flask-pymongo where the package naming is styled flask.ext.whatever and I would have to go VERY far back in time (4 years or so) to make that compatible, which is obviously not preferable.

Here's a tracedump:

rest_api | [2021-04-01 12:11:03,091] ERROR in app: Exception on /oauth/token [POST]
rest_api | Traceback (most recent call last):
rest_api |   File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 2447, in wsgi_app
rest_api |     response = self.full_dispatch_request()
rest_api |   File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1952, in full_dispatch_request
rest_api |     rv = self.handle_user_exception(e)
rest_api |   File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1821, in handle_user_exception
rest_api |     reraise(exc_type, exc_value, tb)
rest_api |   File "/usr/local/lib/python3.7/site-packages/flask/_compat.py", line 39, in reraise
rest_api |     raise value
rest_api |   File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1950, in full_dispatch_request
rest_api |     rv = self.dispatch_request()
rest_api |   File "/usr/local/lib/python3.7/site-packages/flask/app.py", line 1936, in dispatch_request
rest_api |     return self.view_functions[rule.endpoint](**req.view_args)
rest_api |   File "/usr/local/lib/python3.7/site-packages/flask_oauthlib/provider/oauth2.py", line 507, in decorated
rest_api |     uri, http_method, body, headers, credentials
rest_api |   File "/usr/local/lib/python3.7/site-packages/oauthlib/oauth2/rfc6749/endpoints/base.py", line 64, in wrapper
rest_api |     return f(endpoint, uri, *args, **kwargs)
rest_api |   File "/usr/local/lib/python3.7/site-packages/oauthlib/oauth2/rfc6749/endpoints/token.py", line 117, in create_token_response
rest_api |     request, self.default_token_type)
rest_api |   File "/usr/local/lib/python3.7/site-packages/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py", line 109, in create_token_response
rest_api |     self.request_validator.save_token(token, request)
rest_api |   File "/usr/local/lib/python3.7/site-packages/oauthlib/oauth2/rfc6749/request_validator.py", line 246, in save_token
rest_api |     return self.save_bearer_token(token, request, *args, **kwargs)
rest_api |   File "/usr/local/lib/python3.7/site-packages/flask_oauthlib/provider/oauth2.py", line 764, in save_bearer_token
rest_api |     self._tokensetter(token, request, *args, **kwargs)
rest_api |   File "/usr/local/lib/python3.7/site-packages/flask_sentinel/data.py", line 161, in save_token
rest_api |     redis.setex(token.access_token, expires_in, user_id)
rest_api |   File "/usr/local/lib/python3.7/site-packages/redis/client.py", line 1822, in setex
rest_api |     return self.execute_command('SETEX', name, time, value)
rest_api |   File "/usr/local/lib/python3.7/site-packages/redis/client.py", line 900, in execute_command
rest_api |     conn.send_command(*args)
rest_api |   File "/usr/local/lib/python3.7/site-packages/redis/connection.py", line 725, in send_command
rest_api |     self.send_packed_command(self.pack_command(*args),
rest_api |   File "/usr/local/lib/python3.7/site-packages/redis/connection.py", line 775, in pack_command
rest_api |     for arg in imap(self.encoder.encode, args):
rest_api |   File "/usr/local/lib/python3.7/site-packages/redis/connection.py", line 120, in encode
rest_api |     "bytes, string, int or float first." % typename)
rest_api | redis.exceptions.DataError: Invalid input of type: 'ObjectId'. Convert to a bytes, string, int or float first.
rest_api | 172.20.0.1 - - [01/Apr/2021 12:11:03] "POST /oauth/token HTTP/1.1" 500 -

Note: My setup is a network of docker containers, where flask-sentinel is used via eve, hence the rest_api name.

sillydan1 commented 3 years ago

Right now I am using redis version redis~=3.5.3 and I haven't been looking into downgrading that yet. Will look into that, but I don't have high hopes

sillydan1 commented 3 years ago

Downgrading to redis version 2.10.6 seems to fix this issue. Please add it to the requirements

sillydan1 commented 3 years ago

Added a PR