Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve the PKCE validation when client call the Authorization Reques… #11

Merged
merged 1 commit into from
Mar 22, 2024
Merged

Improve the PKCE validation when client call the Authorization Reques… #11

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 22 additions & 8 deletions Server/src/OAuth20.Server/Services/AuthorizeResultService.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,14 @@ public AuthorizeResponse AuthorizeRequest(IHttpContextAccessor httpContextAccess
return response;
}

if (client.Client.UsePkce && string.IsNullOrWhiteSpace(authorizationRequest.code_challenge))
{
response.Error = ErrorTypeEnum.InvalidRequest.GetEnumDescription();
response.ErrorDescription = "code challenge required";
return response;

}


// check the return url is match the one that in the client store
bool redirectUriIsMatched = client.Client.RedirectUri.Equals(authorizationRequest.redirect_uri, StringComparison.OrdinalIgnoreCase);
Expand Down Expand Up @@ -300,17 +308,23 @@ private bool codeVerifierIsSendByTheClientThatReceivedTheCode(string codeVerifie

if (codeChallengeMethod == Constants.ChallengeMethod.Plain)
{
using var shaPalin = SHA256.Create();
var computedHashPalin = shaPalin.ComputeHash(odeVerifireAsByte);
var tranformedResultPalin = Base64UrlEncoder.Encode(computedHashPalin);
return tranformedResultPalin.Equals(codeChallenge);
return codeVerifier.Equals(codeChallenge);
}

using var shaS256 = SHA256.Create();
var computedHashS256 = shaS256.ComputeHash(odeVerifireAsByte);
var tranformedResultS256 = Base64UrlEncoder.Encode(computedHashS256);
else if (codeChallengeMethod == Constants.ChallengeMethod.SHA256)
{

using var shaS256 = SHA256.Create();
var computedHashS256 = shaS256.ComputeHash(odeVerifireAsByte);
var tranformedResultS256 = Base64UrlEncoder.Encode(computedHashS256);

return tranformedResultS256.Equals(codeChallenge);
}
else
{
return false;
}

return tranformedResultS256.Equals(codeChallenge);
}


Expand Down
Loading