Comments (4)
This is a security feature and important to the overall viability of an OAuth2 workflow implementation. As you have worked out for yourself the appropriate way to shut the feature off for development purposes would be to set the insecure transport environment variable, beyond that it is not recommended to short-circuit this process.
Using HTTPS when implementing an OAuth2 workflow is cruical to ensure communications between the authorization/authentication/token exchange servers are secure. Of course there are built in features with the codes and tokens themselves however leaking any of this information still presents risk.
I can sympathize with the urge to circumvent this feature when trying to learn by building, however it doesn't consistute a real "issue" and the focus should really be placed on setting up an HTTPS server. While this can seem like an additional task, it is well worth the effort and peace of mind. There are many resources available online to simplify/soften the learning curve. One of my favorites is Let's Encrypt. I encourage you to consider implementing HTTPS instead of undoing a security check. There's a "follow the flow of the river" thing going on here. Moving the application/project to a secured server is the natural flow, while working around the secure server check is swimming against it.
I can imagine this isn't really the feedback you were hoping for, I'm sorry for that believe me, I am. However I hope this answer still helps paint a better/bigger picture and provides some insight on how you can ultimately accomplish your end goal. We can leave this thread open for now if you'd like follow up.
from requests-oauthlib.
Hi @jtroussard
Thank you for your response and for emphasizing the importance of using HTTPS in OAuth2 workflows. I completely agree that maintaining secure communication is crucial, and I appreciate your suggestion to use resources like Let's Encrypt to simplify the process.
To clarify, our server is already configured to use HTTPS, and we understand the risks associated with disabling security features. Our issue arises specifically when using this particular library. Interestingly, when we integrate Authlib for similar workflows, we don't encounter the same problem. This makes me wonder if there's a specific configuration or compatibility issue with the library in question.
To resolve this, we're seeking guidance on how to ensure that our HTTPS setup is correctly recognized and validated by the library. Are there specific settings or parameters that we need to configure to avoid this issue? Alternatively, if there's a known issue or a workaround that doesn't compromise security, that would be extremely helpful.
Your point about not circumventing security checks is well-taken. Our intention is not to bypass these important features but to understand why our current HTTPS configuration is not being acknowledged by the library and how we can correct this. Any insights or resources you could provide on this matter would be greatly appreciated.
We're committed to maintaining a secure and efficient OAuth2 implementation and are keen to resolve this issue in a way that aligns with best practices. Thank you again for your assistance, and I look forward to any further advice you can offer.
from requests-oauthlib.
Maybe your server is behind a TLS termination proxy that is not set up in a way that Flask understands? If so, this page might help you out: https://flask.palletsprojects.com/en/3.0.x/deploying/proxy_fix/
EDIT: just noticed that you are using Django Rest Framework, not Flask. Considering that, the link I provided will not help; but maybe the fundamental problem is the same?
from requests-oauthlib.
Is there any more information you can provide to frame your specific situation? logs? server configs? recreation steps?
from requests-oauthlib.
Related Issues (20)
- Compliance fix for tokens that never expire (e.g. Mailchimp)
- Redo request after token is updated
- Why is the backend client workflow asking for a code or a response url? HOT 1
- refresh token workflow HOT 1
- rsengun HOT 1
- How to test if LinkedIn token is still valid and re-use? HOT 2
- 1.3.2 release? HOT 3
- LinkedIn issue with multiple scopes HOT 1
- ImportError: No module named parse HOT 3
- Remove 2.7 from setup.py HOT 2
- Access tokens leaked in logs when using DEBUG level
- 1.4.0 claims to support Python 2.7 in PyPI but does not HOT 2
- Changelog suggests Python 3.4-3.6 is unsupported, but project metadata allows these versions
- Release template purposal HOT 2
- Issue refreshing Wix OAuth tokens - cannot send payload as JSON using `refresh_token_request` compliance hook HOT 3
- Can you please add the ability to retrieve and provide the code verifier HOT 1
- BROKEN DOCUMENTATION: Backend Flow
- OAuth 2 web application flow not support PKCE??
- refresh token and required client secret
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from requests-oauthlib.