kumi/django-oidc-provider
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Fix missing verification of response type for client

Browse source
This commit is contained in:
Wojciech Bartosiak 2016-03-08 13:21:55 +00:00
parent 5d57c4919c
commit 08033bb9ad
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
oidc_provider/lib/endpoints/authorize.py
View file

@ -76,6 +76,10 @@ class AuthorizeEndpoint(object):
raise AuthorizeError(self.params.redirect_uri, 'invalid_request',
self.grant_type)
if self.is_authentication and self.params.response_type != self.client.response_type:
raise AuthorizeError(self.params.redirect_uri, 'invalid_request',
self.grant_type)
clean_redirect_uri = urlsplit(self.params.redirect_uri)
clean_redirect_uri = urlunsplit(clean_redirect_uri._replace(query=''))
if not (clean_redirect_uri in self.client.redirect_uris):