f8c696e038
v0.1.1-alpha.18
2020-08-07 17:08:28 +02:00
244eef851f
Merge pull request #1855 from ljupchokotev/auth-frame-csp
...
auth backend: fix CSP by setting script hash
2020-08-07 13:40:29 +02:00
6eb6f08a8a
Add docs for creating a GitHub OAuth application ( #1857 )
2020-08-07 09:15:45 +02:00
353af384da
auth backend: fix CSP by setting script hash
2020-08-06 23:02:09 +02:00
8bfba79801
Merge pull request #1812 from GoWind/abstract_env
...
auth-backend: Encode `env` in the OAuth flow into the `state` parameter. Refs #1775
2020-08-06 18:15:03 +02:00
fcc0080af8
auth-backend: temporary fix for strict CSP being set
2020-08-06 15:37:54 +02:00
959cc6fe86
Refactor: remove env parameter from callbackURL of all OAuth based
...
providers
2020-08-06 12:48:02 +02:00
0dd8fa2828
v0.1.1-alpha.17
2020-08-05 19:36:36 +02:00
5f06a08daa
Address PR comments: Use undefined instead of passing Empty strings
...
Type fn that identifies the env (environment) of a Request
Fail early if `env` is not present in the request or has an invalid
`env` in the state
2020-08-05 17:04:25 +02:00
55d5fb4c2b
Merge pull request #1830 from spotify/dependabot/npm_and_yarn/helmet-4.0.0
...
chore(deps): bump helmet from 3.23.2 to 4.0.0
2020-08-05 13:40:32 +02:00
ae9f757ac3
chore(deps): bump helmet from 3.23.2 to 4.0.0
...
Bumps [helmet](https://github.com/helmetjs/helmet ) from 3.23.2 to 4.0.0.
- [Release notes](https://github.com/helmetjs/helmet/releases )
- [Changelog](https://github.com/helmetjs/helmet/blob/master/CHANGELOG.md )
- [Commits](https://github.com/helmetjs/helmet/compare/v3.23.2...v4.0.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-08-05 08:38:52 +00:00
75467ecb60
Cleanup: Remove deadcode
2020-08-04 18:51:00 +02:00
4ae351b06f
Refactor: Make properties of OAuthState non-optional
2020-08-04 18:48:38 +02:00
cb80b2b4f8
Refactor: encode state Parameters as URLSearchParams instead of JSON
2020-08-04 18:42:16 +02:00
2d20cf389c
Refactor: Address PR Comments
...
Create a new `OAuthState` type for storing the fields we want in the
`state` parameter.
Update the `encodeState` and `readState` fns to use the new `OAuthState`
type.
Update tests to reflect the new type
2020-08-04 17:06:46 +02:00
62222b543c
config-loader,backend-common: refactor config loading to pass in path and use common util for backend
2020-08-03 21:24:44 +02:00
51fad03460
Tests: update tests for OAuthProvider to handle
...
Update OAuthProvider tests to ensure that changes to nonce and
environment handling do not cause regressions
2020-08-03 17:43:16 +02:00
3e5dfbc5f6
Refactor: move encoding state parameters into a separate function
2020-08-03 17:42:48 +02:00
081fe60453
Refactor: parse state query param to read nonce
...
The `state` was modified to be an encoded object of `nonce` and `env`.
When verifying the Nonce value in the callback from the authorization
server, parse the state parameter string to read the right value of
nonce
2020-08-03 15:53:22 +02:00
685f76d913
Encode env in OAuth flow into the state parameter. refs #1775
...
`Env` passed as a separate parameter in the request might break the flow
of the authorization flow. Spotify considers the `env` as a first class
abstraction and use it across their application stack.
To ensure both the existing flow and newer flows are supported, use the
`state` parameter to encode an object, consisting of the `nonce` and the
`env` which is then passed to the authorization server. This parameter
is returned to the application in the callbackURL
2020-08-03 15:33:32 +02:00
f1b96fe8ef
Merge pull request #1783 from AmericanAirlines/ghe
...
Add configuration for github enterprise
2020-07-30 17:19:38 +02:00
64239b9bb3
Merge pull request #1789 from GoWind/remove-scope-check
...
(auth-backend) Bugfix: Do not throw Exception if scopes dont exist. Refs #1786
2020-07-30 17:17:16 +02:00
b625b19978
use cammel case
2020-07-30 09:50:08 -05:00
5cde7069cf
Pass github enterprise base url, derive urls for authentication
2020-07-30 09:33:12 -05:00
448767712b
(auth-backend) Bugfix: Do not throw Exception if scopes dont exist. Refs #1786
...
Currently, the OAuthProvider library in `auth-backend` throws an
Exception if scopes are missing in the `start` (initial) request
in the Authorization flow. Scopes are an optional parameter as per the
spec, so if scopes are empty, simply forward the empty scopes instead of
throwing an Exception
2020-07-30 15:16:54 +02:00
54610c9ba4
auth-backend: set SameSite=Lax for oauth flow cookies
2020-07-30 12:37:02 +02:00
c0feeecc29
Add documentation
2020-07-30 04:53:35 -05:00
c485f7375e
Add configuration for github enterprise
2020-07-30 04:43:02 -05:00
1baccd1304
deps: bump ts, express + friends and fix type issue
2020-07-27 16:06:11 +02:00
19071023cd
fix type issues
2020-07-27 09:07:27 +02:00
60d3ecc695
Read auth providers in backend and frontend from app-config yaml
2020-07-27 09:07:25 +02:00
a852c2f141
config,config-loader: fix lagging versions
2020-07-24 11:38:45 +02:00
bcd7b2661a
v0.1.1-alpha.16
2020-07-24 03:44:39 +02:00
415bdf42e1
v0.1.1-alpha.15
2020-07-22 13:44:33 +02:00
a2955532cc
auth-backend: tweak error messages
2020-07-17 11:00:44 +02:00
af2c948c86
auth-backend: couple of improvements to error message clarity
2020-07-15 20:51:08 +02:00
491d1b70e1
Bump to v0.1.1-alpha.14
2020-07-15 11:49:02 +02:00
3217e85c85
Adds Github to signin page providers ( #1590 )
2020-07-15 11:20:20 +02:00
10d1e141b7
Merge pull request #1504 from danztran/fix_hardcoded_url
...
Replace hardcoded base urls
2020-07-07 14:52:49 +02:00
6fdcc9f59a
v0.1.1-alpha.13
2020-07-07 13:16:30 +02:00
a854568e44
Merge pull request #1500 from timurista/timurista
...
Add gitlab sign in method #343
2020-07-06 19:21:44 +02:00
4f7e2de43c
add backstage identity in test
2020-07-06 10:01:19 -07:00
fe8aa15473
add email for backstage profile
2020-07-06 09:47:19 -07:00
a8b78350e2
rebase master
2020-07-03 16:38:03 +07:00
9472493ff1
extract app origin from base url
2020-07-03 16:34:52 +07:00
87d3922311
replace appUrl with appOrigin
2020-07-03 16:34:52 +07:00
1e29cbea0a
remove TODO
2020-07-03 16:34:52 +07:00
c371e45067
replace hardcoded url
2020-07-03 16:34:52 +07:00
29e442cbc9
Merge pull request #1512 from spotify/freben/oauth2-custom-identity-provider
...
feat(auth): implement generic oauth2 provider
2020-07-03 10:21:06 +02:00
7389f326d9
chore: add import/newline-after-import lint rule
2020-07-02 11:25:04 +02:00
Patrik Oldsberg