User API keys: payload and existing query string leads to a double question mark

blattersturm · 7월 22, 2019, 10:55오전

If I call user-api-key/new with an auth_redirect already containing a query string (e.g. http://localhost:30120/auth-discourse?state=BASE64), I end up with a redirect URI along the likes of http://localhost:30120/auth-discourse?state=BASE64?payload=PAYLOAD - two query strings, and no & appending.

github.com/discourse/discourse

app/controllers/user_api_keys_controller.rb

888e68a16


      
          
          public_key = OpenSSL::PKey::RSA.new(params[:public_key])
          @payload = Base64.encode64(public_key.public_encrypt(@payload))
          
          if scopes.include?("one_time_password")
            # encrypt one_time_password separately to bypass 128 chars encryption limit
            otp_payload = one_time_password(public_key, current_user.username)
          end
          
          if params[:auth_redirect]
            redirect_path = +"#{params[:auth_redirect]}?payload=#{CGI.escape(@payload)}"
            redirect_path << "&oneTimePassword=#{CGI.escape(otp_payload)}" if scopes.include?("one_time_password")
            redirect_to(redirect_path)
          else
            respond_to do |format|
              format.html { render :show }
              format.json do
                instructions = I18n.t("user_api_key.instructions", application_name: @application_name)
                render json: { payload: @payload, instructions: instructions }
              end
            end

This code might need to be changed to check if there’s already a query string in the URI, or perhaps use some URI builder?

eviltrout · 7월 22, 2019, 1:41오후

It does seem like the assumption the code makes is that it doesn’t already contain any query parameters. We’d be open to a PR to fix this.

saurabhp · 7월 23, 2019, 3:50오후

I have opened PR for this issue here:
https://github.com/discourse/discourse/pull/7923

saurabhp · 7월 24, 2019, 2:37오전

PR has been merged. This topic can be closed

글		댓글	조회수
Feasibility of allowing a User Api Key client to register a valid auth_redirect Development	7	461	11월 11, 2024
Redirect after login loses query params Development	9	2200	7월 8, 2019
Support wildcard in "allowed user api auth redirects" setting Feature	0	656	12월 15, 2018
Per User API Keys Not Working Support	2	1269	9월 2, 2021
Generating User Api Keys with REST API Development rest-api	20	8885	4월 8, 2018

User API keys: payload and existing query string leads to a double question mark

Related topics