Class: Doorkeeper::OAuth::ClientAuthentication::ClientSecretBasic

Inherits:
Object
  • Object
show all
Defined in:
lib/doorkeeper/oauth/client_authentication/client_secret_basic.rb

Overview

RFC 6749 §2.3.1 "client_secret_basic": client credentials are sent using HTTP Basic authentication.

Known deviation: §2.3.1 also requires the client_id and client_secret to be form-urlencoded before being placed into the Basic header. Doorkeeper has never URL-decoded them (like much of the ecosystem), and this strategy deliberately keeps that behaviour — adding the decoding now would break every existing client whose credentials contain URL-encodable characters.

Class Method Summary collapse

Class Method Details

.authenticate(request) ⇒ Object 



31
32
33
34
35
36
 
# File 'lib/doorkeeper/oauth/client_authentication/client_secret_basic.rb', line 31

def self.authenticate(request)
  client_id, client_secret = credentials_from(request)
  return unless client_id

  Doorkeeper::ClientAuthentication::Credentials.new(client_id, client_secret)
end

.matches_request?(request) ⇒ Boolean

Match whenever the header decodes to a non-blank client_id — i.e. whenever a Basic authentication attempt is present. The secret may be empty (public clients) or missing; those are still Basic auth attempts and must be claimed here so that invalid credentials fail with invalid_client instead of silently falling through to another configured method or the fallback (which would downgrade a failed authentication attempt to "no authentication provided").

Returns:

  • (Boolean) 


27
28
29
 
# File 'lib/doorkeeper/oauth/client_authentication/client_secret_basic.rb', line 27

def self.matches_request?(request)
  credentials_from(request).present?
end

.uses_shared_secret? ⇒ Boolean

Returns:

  • (Boolean) 


16
17
18
 
# File 'lib/doorkeeper/oauth/client_authentication/client_secret_basic.rb', line 16

def self.uses_shared_secret?
  true
end