From 2f7fd6cde2e10a9980ad4ef2e438d6b93769e613 Mon Sep 17 00:00:00 2001 From: Joel Stevenson Date: Fri, 29 Apr 2016 09:29:22 -0700 Subject: Prevent save_token() from being called twice within create_token_response(). We call save_token() after any token modifiers have run so we can tell the token_handler's create_token() method not to save the token and do that explicitly ourselves. --- oauthlib/oauth2/rfc6749/grant_types/authorization_code.py | 10 +++++++--- oauthlib/oauth2/rfc6749/grant_types/client_credentials.py | 2 +- oauthlib/oauth2/rfc6749/grant_types/implicit.py | 2 +- oauthlib/oauth2/rfc6749/grant_types/refresh_token.py | 2 +- .../rfc6749/grant_types/resource_owner_password_credentials.py | 2 +- 5 files changed, 11 insertions(+), 7 deletions(-) (limited to 'oauthlib/oauth2/rfc6749/grant_types') diff --git a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py index 2466c0d..91d7615 100644 --- a/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py +++ b/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py @@ -138,7 +138,10 @@ class AuthorizationCodeGrant(GrantTypeBase): using the "application/x-www-form-urlencoded" format, per `Appendix B`_: response_type - REQUIRED. Value MUST be set to "code". + REQUIRED. Value MUST be set to "code" for standard OAuth2 + authorization flow. For OpenID Connect it must be one of + "code token", "code id_token", or "code token id_token" - we + essentially test that "code" appears in the response_type. client_id REQUIRED. The client identifier as described in `Section 2.2`_. redirect_uri @@ -264,7 +267,7 @@ class AuthorizationCodeGrant(GrantTypeBase): log.debug('Client error during validation of %r. %r.', request, e) return headers, e.json, e.status_code - token = token_handler.create_token(request, refresh_token=self.refresh_token) + token = token_handler.create_token(request, refresh_token=self.refresh_token, save_token=False) for modifier in self._token_modifiers: token = modifier(token, token_handler, request) self.request_validator.save_token(token, request) @@ -347,7 +350,8 @@ class AuthorizationCodeGrant(GrantTypeBase): # REQUIRED. if request.response_type is None: raise errors.MissingResponseTypeError(request=request) - # Value MUST be set to "code". + # Value MUST be set to "code" or one of the OpenID authorization code including + # response_types "code token", "code id_token", "code token id_token" elif not 'code' in request.response_type and request.response_type != 'none': raise errors.UnsupportedResponseTypeError(request=request) diff --git a/oauthlib/oauth2/rfc6749/grant_types/client_credentials.py b/oauthlib/oauth2/rfc6749/grant_types/client_credentials.py index 1d9d2df..91c17a6 100644 --- a/oauthlib/oauth2/rfc6749/grant_types/client_credentials.py +++ b/oauthlib/oauth2/rfc6749/grant_types/client_credentials.py @@ -81,7 +81,7 @@ class ClientCredentialsGrant(GrantTypeBase): log.debug('Client error in token request. %s.', e) return headers, e.json, e.status_code - token = token_handler.create_token(request, refresh_token=False) + token = token_handler.create_token(request, refresh_token=False, save_token=False) for modifier in self._token_modifiers: token = modifier(token) diff --git a/oauthlib/oauth2/rfc6749/grant_types/implicit.py b/oauthlib/oauth2/rfc6749/grant_types/implicit.py index 539a0b4..2581f14 100644 --- a/oauthlib/oauth2/rfc6749/grant_types/implicit.py +++ b/oauthlib/oauth2/rfc6749/grant_types/implicit.py @@ -245,7 +245,7 @@ class ImplicitGrant(GrantTypeBase): # "id_token token" - return the access token and the id token # "id_token" - don't return the access token if "token" in request.response_type.split(): - token = token_handler.create_token(request, refresh_token=False) + token = token_handler.create_token(request, refresh_token=False, save_token=False) else: token = {} diff --git a/oauthlib/oauth2/rfc6749/grant_types/refresh_token.py b/oauthlib/oauth2/rfc6749/grant_types/refresh_token.py index 209b8a2..cb26880 100644 --- a/oauthlib/oauth2/rfc6749/grant_types/refresh_token.py +++ b/oauthlib/oauth2/rfc6749/grant_types/refresh_token.py @@ -61,7 +61,7 @@ class RefreshTokenGrant(GrantTypeBase): return headers, e.json, e.status_code token = token_handler.create_token(request, - refresh_token=self.issue_new_refresh_tokens) + refresh_token=self.issue_new_refresh_tokens, save_token=False) for modifier in self._token_modifiers: token = modifier(token) diff --git a/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py b/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py index 16690ae..0f4d65e 100644 --- a/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py +++ b/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py @@ -114,7 +114,7 @@ class ResourceOwnerPasswordCredentialsGrant(GrantTypeBase): log.debug('Client error in token request, %s.', e) return headers, e.json, e.status_code - token = token_handler.create_token(request, self.refresh_token) + token = token_handler.create_token(request, self.refresh_token, save_token=False) for modifier in self._token_modifiers: token = modifier(token) -- cgit v1.2.1