Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Various OAuth bug fixes #85

Merged
merged 7 commits into from
Feb 27, 2018
Merged

Various OAuth bug fixes #85

Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
51df965
Fix OAuth.init
eatyourgreens Feb 26, 2018
9800400
Replace parseURL with tokenFromLocation
eatyourgreens Feb 26, 2018
ed3f347
Clearly delineate helper functions in code
eatyourgreens Feb 26, 2018
36121ca
Always set auth headers on init
eatyourgreens Feb 26, 2018
edf0711
_handleNewBearerToken should validate the token
eatyourgreens Feb 26, 2018
87ca45d
2.9.4
eatyourgreens Feb 27, 2018
d6eb3dd
changelog
eatyourgreens Feb 27, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 24 additions & 17 deletions lib/oauth.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ module.exports = new Model({
// Handle new token details if we've completed a sign in
if (checkUrlForToken(window.location.hash)) {
console.log('Token found in URL');
var tokenDetails = parseUrl(window.location.hash);
var tokenDetails = tokenFromLocation(window.location);
this._handleNewBearerToken(tokenDetails);

// And redirect to the desired page
Expand All @@ -88,6 +88,10 @@ module.exports = new Model({

// If not, let's try and pick up an existing Panoptes session anyway
this.checkBearerToken()
.then(function (tokenDetails) {
this._handleNewBearerToken(tokenDetails);
resolve(tokenDetails);
}.bind(this))
.catch(function (error) {
// We probably haven't signed in before
console.info(error);
Expand Down Expand Up @@ -193,10 +197,10 @@ module.exports = new Model({
// with a more relevant one.
this._iframe.onload = function() {
try {
var newUrl = this._iframe.contentWindow.location.href;
if (checkUrlForToken(newUrl)) {
var iframeLocation = this._iframe.contentWindow.location;
if (checkUrlForToken(iframeLocation.hash)) {
console.info('Found existing Panoptes session');
var newTokenDetails = parseUrl(newUrl);
var newTokenDetails = tokenFromLocation(iframeLocation);
resolve(newTokenDetails);
} else {
throw new TypeError('Valid OAuth details not found in URL');
Expand Down Expand Up @@ -253,15 +257,17 @@ module.exports = new Model({
},

_handleNewBearerToken: function(tokenDetails) {
console.log('Got new bearer token', tokenDetails.access_token.slice(-6));
this._tokenDetails = tokenDetails;
apiClient.headers.Authorization = 'Bearer ' + tokenDetails.access_token;

var refresh = this._refreshBearerToken.bind(this);
var timeToRefresh = (tokenDetails.expires_in * 1000) - TOKEN_EXPIRATION_ALLOWANCE;
this._bearerRefreshTimeout = setTimeout(refresh, timeToRefresh);
tokenDetails.expires_at = Date.now() + (tokenDetails.expires_in * 1000);
SESSION_STORAGE.setItem(LOCAL_STORAGE_PREFIX + 'tokenDetails', JSON.stringify(tokenDetails));
if (tokenDetails && tokenDetails.access_token) {
console.log('Got new bearer token', tokenDetails.access_token.slice(-6));
this._tokenDetails = tokenDetails;
apiClient.headers.Authorization = 'Bearer ' + tokenDetails.access_token;

var refresh = this._refreshBearerToken.bind(this);
var timeToRefresh = (tokenDetails.expires_in * 1000) - TOKEN_EXPIRATION_ALLOWANCE;
this._bearerRefreshTimeout = setTimeout(refresh, timeToRefresh);
tokenDetails.expires_at = Date.now() + (tokenDetails.expires_in * 1000);
SESSION_STORAGE.setItem(LOCAL_STORAGE_PREFIX + 'tokenDetails', JSON.stringify(tokenDetails));
}
return tokenDetails;
},

Expand All @@ -284,15 +290,16 @@ module.exports = new Model({
}

});

// Utility functions
/*******************************************
Utility functions
*******************************************/
function checkUrlForToken(string) {
return string.indexOf('access_token') !== -1 &&
string.indexOf('token_type=bearer') !== -1;
}

function parseUrl(string) {
var params = string.slice(1).split('&');
function tokenFromLocation(loc) {
var params = loc.hash.slice(1).split('&');
var tokenDetails = {};
params.forEach(function(paramString) {
var param = paramString.split('=');
Expand Down