[bug] /oauth/authorize with non-truthy force_login returns wrong code #529
Labels
No labels
approved, awaiting change
bug
configuration
documentation
duplicate
enhancement
extremely low priority
feature request
Fix it yourself
help wanted
invalid
mastodon_api
needs docs
needs tests
not a bug
planned
pleroma_api
privacy
question
static_fe
triage
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: AkkomaGang/akkoma#529
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Your setup
From source
Extra details
No response
Version
08d49fb
PostgreSQL version
No response
What were you trying to do?
I created an oauth app on kwsp using mastodon-py for use with the oob redirect uri
I generated the /oauth/authorize URL with mastodon-py and it came out as something with
&force_login=False&state=None&lang=None
which is eh but okayI tried to use the URL to log in with my main account in browser, which was already logged into FE
What did you expect to happen?
An approve/deny form, followed by a token to copy into my code to finish auth flow
What actually happened?
After approving, it showed me a token, I pasted it into my code, it didn't work. After some digging I noticed that the same token was in FE's vuex storage, under
oauth.userToken
, which suggests it was giving me the auth code for my logged in FE instead of the app I actually wanted to log in to.I'm observing the same behaviour if I set force_login to empty string but keep it. If I remove force_login it gives me a different code, one that works for completing the oauth flow. If I set it to "hehe" or whatever it forces reapproval and it's fine.
I tried reading
lib/pleroma/web/o_auth/o_auth_controller.ex
but I don't really understand plugsLogs
No response
Severity
I can manage
Have you searched for this issue?
[bug] /oauth/authorize with non-truthy non-empty force_login returns wrong codeto [bug] /oauth/authorize with non-truthy force_login returns wrong code