feat(auth): OAuth2 access_token in GET query string in userInfoURL #5188
Conversation
|
I'm still thinking about adding only a prop in the definition.yml instead. My solution might create backward-compatibility issues (well, only if someone relies on using an |
|
This should indeed be optional and off by default. |
|
@NGPixel Applied your suggested modifications, tested it manually with fresh database with my oauth2 config, worked very well. |
| this._oauth2._useAuthorizationHeaderForGET = true | ||
| } else { | ||
| this._oauth2._useAuthorizationHeaderForGET = false | ||
| url.searchParams.set('access_token', accesstoken) |
There was a problem hiding this comment.
You're creating an url variable, set a searchParams but then it's never used again? Am I missing something?
Also the current default would cause existing installations to suddenly use the opposite behavior. Either set the useAuthorizationHeader default as true or reverse the logic...
There was a problem hiding this comment.
Completely forgot about the url variable. Will reverse the logic. Thx for the review gonna mend the things and test them again.
See #5187
Small patch for using older OAuth2 authorization servers