Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add oauth state parameter verification to cloudflare-api example #103

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

add oauth state parameter verification to cloudflare-api example #103

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
008ce67
add oauth state parameter verification to cloudflare-api example
zxt-tzx Dec 22, 2024
125dbc4
use 1 per Redis convention
zxt-tzx Dec 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 11 additions & 5 deletions examples/client/cloudflare-api/api.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
import type { Service } from "@cloudflare/workers-types"
import type { Service, KVNamespace } from "@cloudflare/workers-types"
import { createClient } from "@openauthjs/openauth/client"
import { subjects } from "../../subjects"

interface Env {
OPENAUTH_ISSUER: string
Auth: Service
AuthKV: KVNamespace
CloudflareAuth: Service
}

Expand All @@ -23,6 +24,10 @@ export default {
case "/callback":
try {
const code = url.searchParams.get("code")!
const state = url.searchParams.get("state")!
const challenge = await env.AuthKV.get(`oauth:challenge ${state}`)
if (!challenge) throw new Error("Invalid state")
await env.AuthKV.delete(`oauth:challenge ${state}`)
const exchanged = await client.exchange(code, redirectURI)
if (exchanged.err) throw new Error("Invalid code")
const response = new Response(null, { status: 302, headers: {} })
Expand All @@ -37,10 +42,11 @@ export default {
return new Response(e.toString())
}
case "/authorize":
return Response.redirect(
await client.authorize(redirectURI, "code").then((v) => v.url),
302,
)
const { state } = await client.authorize(redirectURI, "code")
await env.AuthKV.put(`oauth:challenge ${state}`, "1", {
expirationTtl: 60, // in seconds
})
return Response.redirect(url, 302)
case "/":
const cookies = new URLSearchParams(
request.headers.get("cookie")?.replaceAll("; ", "&"),
Expand Down