00dani/lemoncurry
1
0
Fork 1
Code Issues Pull requests Releases Wiki Activity

Improve JWT security by specifying the algorithm used, and also use shorter key names to make the code a little shorter

Browse source
This commit is contained in:
Danielle McLean 2017-11-03 14:33:27 +11:00
parent 6b1cd896ea
commit 6f6bb4e534
Signed by: 00dani
GPG key ID: 5A5D2D1AFF12EEC5
2 changed files with 11 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

7
lemonauth/views/indie.py
View file

@ -73,7 +73,6 @@ class IndieView(TemplateView):
.get('rels', ()))
verified = 'redirect_uri' in rels
try:
app = client.to_dict(filter_by_type='h-x-app')[0]['properties']
except IndexError:
@ -98,13 +97,13 @@ class IndieView(TemplateView):
# out immediately.
return utils.forbid('invalid auth code')
if code['response_type'] != 'id':
if code['typ'] != 'id':
return utils.bad_req(
'this endpoint only supports response_type=id'
)
if post.get('client_id') != code['client_id']:
if code['id'] != post.get('client_id'):
return utils.forbid('client id did not match')
if post.get('redirect_uri') != code['redirect_uri']:
if code['uri'] != post.get('redirect_uri'):
return utils.forbid('redirect uri did not match')
# If we got here, it's valid! Yay!