Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def test_code_id_token_access_token(self):
self.prepare_data()
rv = self.client.post('/oauth/authorize', data={
'client_id': 'hybrid-client',
'response_type': 'code id_token token',
'state': 'bar',
'nonce': 'abc',
'scope': 'openid profile',
'redirect_uri': 'https://a.b',
'user_id': '1',
})
self.assertIn('code=', rv.location)
self.assertIn('id_token=', rv.location)
self.assertIn('access_token=', rv.location)
params = dict(url_decode(urlparse.urlparse(rv.location).fragment))
self.assertEqual(params['state'], 'bar')
self.validate_claims(params['id_token'], params)
code = params['code']
headers = self.create_basic_header('hybrid-client', 'hybrid-secret')
rv = self.client.post('/oauth/token', data={
'grant_type': 'authorization_code',
'redirect_uri': 'https://a.b',
'code': code,
}, headers=headers)
resp = json.loads(rv.data)
self.assertIn('access_token', resp)
self.assertIn('id_token', resp)
def test_plain_code_challenge_success(self):
self.prepare_data()
code_verifier = generate_token(48)
url = self.authorize_url + '&code_challenge=' + code_verifier
rv = self.client.post(url, data={'user_id': '1'})
self.assertIn('code=', rv.location)
params = dict(url_decode(urlparse.urlparse(rv.location).query))
code = params['code']
rv = self.client.post('/oauth/token', data={
'grant_type': 'authorization_code',
'code': code,
'code_verifier': code_verifier,
'client_id': 'code-client',
})
resp = json.loads(rv.data)
self.assertIn('access_token', resp)
def test_pure_code_flow(self):
self.prepare_data()
rv = self.client.post('/oauth/authorize', data={
'response_type': 'code',
'client_id': 'code-client',
'state': 'bar',
'scope': 'profile',
'redirect_uri': 'https://a.b',
'user_id': '1'
})
self.assertIn('code=', rv.location)
params = dict(url_decode(urlparse.urlparse(rv.location).query))
self.assertEqual(params['state'], 'bar')
code = params['code']
headers = self.create_basic_header('code-client', 'code-secret')
rv = self.client.post('/oauth/token', data={
'grant_type': 'authorization_code',
'redirect_uri': 'https://a.b',
'code': code,
}, headers=headers)
resp = json.loads(rv.data)
self.assertIn('access_token', resp)
self.assertNotIn('id_token', resp)
def test_token_generator(self):
m = 'tests.flask.test_oauth2.oauth2_server:token_generator'
self.app.config.update({'OAUTH2_ACCESS_TOKEN_GENERATOR': m})
self.prepare_data(False, token_endpoint_auth_method='none')
rv = self.client.post(self.authorize_url, data={'user_id': '1'})
self.assertIn('code=', rv.location)
params = dict(url_decode(urlparse.urlparse(rv.location).query))
code = params['code']
rv = self.client.post('/oauth/token', data={
'grant_type': 'authorization_code',
'code': code,
'client_id': 'code-client',
})
resp = json.loads(rv.data)
self.assertIn('access_token', resp)
self.assertIn('c-authorization_code.1.', resp['access_token'])