suimeng
/
honojs-middleware
mirror of https://github.com/honojs/middleware.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix: ensure state is passed through for both github app types (#279)

pull/281/head
David Flanagan 2023-11-28 20:34:49 +00:00 committed by GitHub
parent 4aa5f67c1b
commit cfaa80a9e7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
.changeset/hip-owls-give.md 100644
View File

@ -0,0 +1,5 @@
---
'@hono/oauth-providers': patch
---
ensure CSRF state returned to GitHub apps

12
packages/oauth-providers/src/providers/github/authFlow.ts
View File

@ -43,15 +43,15 @@ export class AuthFlow {
redirect() { redirect() {
const url = 'https://github.com/login/oauth/authorize?' const url = 'https://github.com/login/oauth/authorize?'
if (this.oauthApp) { const queryParams = toQueryParams({
const parsedScope = toQueryParams({ client_id: this.client_id,
scope: this.scope,
state: this.state, state: this.state,
// For GitHub apps, the scope is configured during the app setup / creation.
// For OAuth apps, we need to provide the scope.
...(this.oauthApp && { scope: this.scope }),
}) })
return `${url}${parsedScope}&client_id=${this.client_id}`
}
return `${url}client_id=${this.client_id}` return url.concat(queryParams);
} }
private async getTokenFromCode() { private async getTokenFromCode() {