This repository has been archived by the owner on Apr 11, 2024. It is now read-only.
Don't include extra params when calculating local hmac #196
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
paulomarg
approved these changes
Jun 11, 2021
|
We got some nice CI errors (I think we're not expecting the Just checking: did you make sure that the hash matches on an actual request with the host? |
paulomarg
reviewed
Jun 11, 2021
src/auth/oauth/types.ts
Outdated
| shopify?: string[]; | ||
| } | ||
|
|
||
| export interface LocalHmacQuery { |
There was a problem hiding this comment.
Do we need the extra type here? We'll just ignore fields that we don't care about, so it wouldn't hurt to just use AuthQuery instead, would it?
src/utils/hmac-validator.ts
Outdated
| const {hmac, code, timestamp, state, shop} = query; | ||
| const localHmac = generateLocalHmac({code, timestamp, state, shop}); | ||
| const {hmac, code, timestamp, state, shop, host} = query; | ||
| const localHmac = generateLocalHmac({code, timestamp, state, shop, ...host && {host}}); |
There was a problem hiding this comment.
I also realized that we might want to do this in generateLocalHmac instead, to make sure we're always filtering out the keys we don't want.
# for free
to subscribe to this conversation on GitHub.
Already have an account?
#.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
WHY are these changes introduced?
Encountered a situation where the returned query contained an extra key:value (
shopify: ['callback']) which was then added to the local HMAC querystring and resulted in a false match and broken auth flow.WHAT is this pull request doing?
This change makes sure we are only passing the key:values we want when creating the local hmac.
Type of change
Checklist