search

socialcast / devise_oauth2_providable

Rails3 engine integrating OAuth2 authentication with Devise
MIT License
220 stars 102 forks source link

undefined method 'uid=' for Rack::OAuth2::Server::Authorize::Token::Response #41

Open JeanMertz opened 12 years ago

JeanMertz commented 12 years ago

I'm getting an undefined_method error when I try to grant access to a Backbone app using a token.

Here's the log:

NoMethodError (undefined method `uid=' for #<Rack::OAuth2::Server::Authorize::Token::Response:0x007fa4a0183818>):
  /Users/Jean/.rbenv/versions/1.9.3-p125/lib/ruby/gems/1.9.1/bundler/gems/devise_oauth2_providable-e329bc1afbd6/app/controllers/devise/oauth2_providable/authorizations_controller.rb:46:in `block in authorize_endpoint'
  rack-oauth2 (0.11.0) lib/rack/oauth2/server/abstract/handler.rb:13:in `call'
  rack-oauth2 (0.11.0) lib/rack/oauth2/server/abstract/handler.rb:13:in `call'
  rack-oauth2 (0.11.0) lib/rack/oauth2/server/authorize/token.rb:9:in `call'
  rack-oauth2 (0.11.0) lib/rack/oauth2/server/authorize.rb:7:in `call'

If I look at the code causing the error at authorizations_controller.rb#L46 and compare that with Rack::Oauth2's token.rb#L59 then it seems Rack::Oauth2 doesn't accept the uid attribute.

Am I doing something wrong? Or has something changed in Rack::Oauth2 that is incompatible with this gem? I looked at their commits in the last few days, but couldn't find anything related to this issue.

_Removing the provided line in devise_oauth2_providable "fixes" the issue, but since I don't see the uid being used anywhere I am not sure if this causes a security issue or not._

Arjeno commented 12 years ago

Confirmed. I have the same problem.

wireframe commented 12 years ago

can you confirm this with a unit test?

mikejihbe commented 11 years ago

This only happens when you ask for a response_type=token, it works fine if you ask for a response_type=code.

describe 'POST #create' do context 'with valid redirect_uri' do with :user with :client let(:redirect_uri) { client.redirect_uri } before do sign_in user post :create, :commit => 'Approve', :approve => true, :client_id => client.identifier, :redirect_uri => redirect_uri, :response_type => 'token', :use_route => 'devise_oauth2_providable' end it { should respond_with :redirect } it { should respond_with_content_type :html } end end