wagnerdelima / drf-social-oauth2

drf-social-oauth2 makes it easy to integrate Django social authentication with major OAuth2 providers, i.e., Facebook, Twitter, Google, etc.
https://drf-social-oauth2.readthedocs.io/en/latest/
MIT License
269 stars 34 forks source link

2000 character limit exceeded using convert token endpoint #214

Closed ex8 closed 2 months ago

ex8 commented 3 months ago

I get an error when I try to convert the Microsoft Azure token to DRF access token using the convert-token endpoint.

I have been getting this error: {"token":["Ensure this field has no more than 2000 characters."]}

I notice in the ConvertTokenSerializer serializer the max_length is set to 2000.

class ConvertTokenSerializer(Serializer):
    grant_type = CharField(max_length=50)
    backend = CharField(max_length=200)
    client_id = CharField(max_length=200)
    client_secret = CharField(max_length=500)
    token = CharField(max_length=2000)

This is the curl command I ran curl -X POST -d "grant_type=convert_token&client_id=xxxxxxxxxxxxxxxxx&client_secret=xxxxxxxxxxxxxxx&backend=azuread-v2-tenant-oauth2&token=MY_TOKEN_THAT_IS_3000_CHARS" http://localhost:8000/auth/convert-token

The token is exceeding the 2000 character but it cannot be controlled as Microsoft generates this. I have tried numerous times to reduce the scope on Microsoft's end to limit the length of token but I am unable to do this.

I am not sure if this is by design or this is a bug, please kindly advise. I appreciate the time and respect the effort required to fix this issue if deemed a bug. I fully support the use and creation of this library. Thank you.

ex8 commented 2 months ago

https://github.com/wagnerdelima/drf-social-oauth2/pull/216 fixes this.