treehouse
/
mastodon
21
8
Fork 5
Code Issues 32 Pull Requests Projects 1 Releases Wiki Activity

When OAuth password verification fails, return 401 instead of redirect (#5111) 

Call to warden.authenticate! in resource_owner_from_credentials would
make the request redirect to sign-in path, which is a bad response for
apps. Now bad credentials just return nil, which leads to HTTP 401
from Doorkeeper. Also, accounts with enabled 2FA cannot be logged into
this way.
lolsob-rspec
Eugen Rochko 2017-09-27 23:42:49 +02:00 committed by GitHub
parent 12b7306a03
commit 7031e350b3
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
config/initializers/doorkeeper.rb
View File

@ -7,15 +7,14 @@ Doorkeeper.configure do
current_user || redirect_to(new_user_session_url) current_user || redirect_to(new_user_session_url)
end end
resource_owner_from_credentials do |routes| resource_owner_from_credentials do |_routes|
request.params[:user] = { email: request.params[:username], password: request.params[:password] } user = User.find_by(email: request.params[:username])
request.env["devise.allow_params_authentication"] = true user if !user&.otp_required_for_login? && user&.valid_password?(request.params[:password])
request.env["warden"].authenticate!(scope: :user)
end end
# If you want to restrict access to the web interface for adding oauth authorized applications, you need to declare the block below. # If you want to restrict access to the web interface for adding oauth authorized applications, you need to declare the block below.
admin_authenticator do admin_authenticator do
(current_user && current_user.admin?) || redirect_to(new_user_session_url) current_user&.admin? || redirect_to(new_user_session_url)
end end
# Authorization Code expiration time (default 10 minutes). # Authorization Code expiration time (default 10 minutes).