search

sudocode / ohmy-auth

OAuth made easy for PHP (deprecated)
BSD 3-Clause "New" or "Revised" License
1 stars 1 forks source link

Inject unique oauth_nonce in every instance of Signature that gets created to enforce unique nonce. #10

Open rayburgemeestre opened 10 years ago

rayburgemeestre commented 10 years ago

Reason for this fix: communication against a more strict OAuth server will deny the requests due to possible replay attack, as the same nonce token is used for the request/access & actual call for the resource.

I didn't solve this inside the Signature class because I think that class should not do anything by itself.

Only fixed this for Two Legged Oauth, but perhaps we should fix this in all places where a Signature class is instantiated.

(If the logic is to be moved inside the Signature class, note that several unit tests will fail.)

rayburgemeestre commented 10 years ago

I was just told that this is how Oauth 1.0a worked. So probably my fix breaks Oauth 2.0, this PR can probably be closed/ignored..