Class: Doorkeeper::OAuth::ClientAuthentication::None

Inherits:
Object
  • Object
show all
Defined in:
lib/doorkeeper/oauth/client_authentication/none.rb

Overview

RFC 6749 §2.3 "none": a public client that authenticates with only a client_id and no secret (in the request body, not the query string).

Class Method Summary collapse

Class Method Details

.authenticate(request) ⇒ Object 



63
64
65
66
67
 
# File 'lib/doorkeeper/oauth/client_authentication/none.rb', line 63

def self.authenticate(request)
  params = request.request_parameters.with_indifferent_access

  Doorkeeper::ClientAuthentication::Credentials.new(params[:client_id], nil)
end

.matches_request?(request) ⇒ Boolean

Rejects a request that carries header-based client authentication (a Basic credential, or any non-blank Authorization header that is not a bearer token): such a request must not be silently treated as an unauthenticated public client. This is narrower than the legacy from_params extractor, which read the body client_id regardless of the Authorization header.

A Bearer Authorization header is the exception: it authorizes access to the endpoint itself (e.g. a bearer-protected introspection endpoint, RFC 7662 §2.1, or a revocation request) rather than authenticating the client, so it must not suppress the none strategy for a public client that identifies itself with a body client_id.

A request carrying a client_assertion is likewise attempting real client authentication (RFC 7521 allows a bare client_id next to the assertion), so it must not be picked up as an unauthenticated public client no matter where this method sits in the configured order.

Returns:

  • (Boolean) 


33
34
35
36
37
38
39
40
41
 
# File 'lib/doorkeeper/oauth/client_authentication/none.rb', line 33

def self.matches_request?(request)
  params = request.request_parameters.with_indifferent_access

  request.post? &&
    !client_authentication_header?(request) &&
    params[:client_id].present? &&
    params[:client_secret].blank? &&
    params[:client_assertion].blank?
end

.uses_shared_secret? ⇒ Boolean

The absence of client authentication involves no secret at all.

Returns:

  • (Boolean) 


10
11
12
 
# File 'lib/doorkeeper/oauth/client_authentication/none.rb', line 10

def self.uses_shared_secret?
  false
end