SSO and e-mail addresses having a plus sign

지원
1

I’m not sure if this is an implementation error on my side or if this is a bug in the SSO implementation of Discourse.
Users having a plus-extension in the local part of their e-mail address got an error since Discourse interpretes the plus sign as space.

Following Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso) I must not urlencode the payload before encoding it to base64.

Here my basic implementation, written in php:

$email = 'user+extension@example.com';
$payload = base64_encode($nonce. "&email={$email}&external_id={$external_id}&username={$realname}&name={$realname}");
$return_sig = hash_hmac('sha256', $payload, $token);
header("Location: $referer/session/sso_login?sso=". rawurlencode($payload) ."&sig=". $return_sig);

Discourse throws the error: “Nonce has already expired” and writes down the e-mail address as “user extension@example.com” with a space instead of a plus sign.

2

You need "nonce=" . $nonce. there…

3

This is already there and was not the reason for my request.

(
    $nonce = base64_decode($sso);
    # starts with nonce=...
)
4

조금 늦은 것 같습니다. 하지만 다른 분들도 같은 문제에 부딪히지 않도록 공유합니다.

사실 base64 인코딩 전에 페이로드를 urlencode해야 합니다. 저희 워드프레스 플러그인과 루비 구현 모두 페이로드를 구성할 때 라이브러리 함수를 사용하며, 이 함수들이 인코딩을 자동으로 처리합니다.

문서를 더 명확하게 수정했습니다: