search

socialcast / devise_oauth2_providable

Rails3 engine integrating OAuth2 authentication with Devise
MIT License
217 stars 102 forks source link

Websafe tokens #4

Closed wrimle closed 13 years ago

wrimle commented 13 years ago

I am trying to get up to grabs with devise_oath2_providable, and noticed that the tokens are not web safe. This patch changes this, making it simpler to play around and test. The default identifier is shortened as well, but that is not really the point of the patch.

wireframe commented 13 years ago

ActiveSupport::SecureRandom.urlsafe_base64 is not a defined method. did you intend to use the core ruby lib SecureRandom.urlsafe_base64? the core SecureRandom.urlsafe_base64 method is only defined in ruby 1.9 and unless there is a ruby 1.8 equivalent, I will not be able to apply this patch.

wrimle commented 13 years ago

I actually found it by running ActiveSupport::SecureRandom::methods.sort from the rails console, so it at least it is defined when running rails3.0.7 and ruby 1.9.2-p180. I tried doing the same with ruby 1.8 and rails 2.3.4, and you are right. it failed.

The functionality is identical to running:

ActiveSupport::SecureRandom.base64.tr('+/', '-_').tr('=', '')

So if you agree to the functionality we could do that instead, as it is backward compatible.

wireframe commented 13 years ago

That sounds good to me. can you update your branch with the change?

wrimle commented 13 years ago

Updated and rebased. An interesting git exercise.

wireframe commented 13 years ago

resolved by using hex values for the tokens