From 46287639982a046aeeec3e610de73265540fb5ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Thu, 12 Nov 2020 11:43:35 +0100 Subject: [PATCH] auth-backend: Encode the OAuth state param using URL safe chars (#3281) --- .changeset/tidy-bobcats-prove.md | 5 +++++ plugins/auth-backend/src/lib/oauth/helpers.ts | 4 ++-- 2 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 .changeset/tidy-bobcats-prove.md diff --git a/.changeset/tidy-bobcats-prove.md b/.changeset/tidy-bobcats-prove.md new file mode 100644 index 0000000000..ad73d547e0 --- /dev/null +++ b/.changeset/tidy-bobcats-prove.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-auth-backend': patch +--- + +Encode the OAuth state parameter using URL safe chars only, so that providers have an easier time forming the callback URL. diff --git a/plugins/auth-backend/src/lib/oauth/helpers.ts b/plugins/auth-backend/src/lib/oauth/helpers.ts index 9f250a0285..bc6fcf1004 100644 --- a/plugins/auth-backend/src/lib/oauth/helpers.ts +++ b/plugins/auth-backend/src/lib/oauth/helpers.ts @@ -19,7 +19,7 @@ import { OAuthState } from './types'; export const readState = (stateString: string): OAuthState => { const state = Object.fromEntries( - new URLSearchParams(decodeURIComponent(stateString)), + new URLSearchParams(Buffer.from(stateString, 'hex').toString('utf-8')), ); if ( !state.nonce || @@ -40,7 +40,7 @@ export const encodeState = (state: OAuthState): string => { searchParams.append('nonce', state.nonce); searchParams.append('env', state.env); - return encodeURIComponent(searchParams.toString()); + return Buffer.from(searchParams.toString(), 'utf-8').toString('hex'); }; export const verifyNonce = (req: express.Request, providerId: string) => {