colin
/
bookstack
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

OIDC: Added extra userinfo content-type normalisation and test 

During review of #5337
This commit is contained in:
Dan Brown 2024-11-28 16:58:06 +00:00
parent 17f7afe12d
commit bc1f1d92e5
No known key found for this signature in database
GPG Key ID: 46D9F943C24A2EF9
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/Access/Oidc/OidcUserinfoResponse.php
View File

@ -11,7 +11,9 @@ class OidcUserinfoResponse implements ProvidesClaims
public function __construct(ResponseInterface $response, string $issuer, array $keys)
{
$contentType = explode(';', $response->getHeader('Content-Type')[0], 2)[0];
$contentTypeHeaderValue = $response->getHeader('Content-Type')[0] ?? '';
$contentType = strtolower(trim(explode(';', $contentTypeHeaderValue, 2)[0]));
if ($contentType === 'application/json') {
$this->claims = json_decode($response->getBody()->getContents(), true);
}

14
tests/Auth/OidcTest.php
View File

@ -787,6 +787,20 @@ class OidcTest extends TestCase
$this->assertTrue($user->hasRole($roleA->id));
}
public function test_userinfo_endpoint_response_with_complex_json_content_type_handled()
{
$userinfoResponseData = [
'sub' => OidcJwtHelper::defaultPayload()['sub'],
'name' => 'Barry',
];
$userinfoResponse = new Response(200, ['Content-Type' => 'Application/Json ; charset=utf-8'], json_encode($userinfoResponseData));
$resp = $this->runLogin(['name' => null], [$userinfoResponse]);
$resp->assertRedirect('/');
$user = User::where('email', OidcJwtHelper::defaultPayload()['email'])->first();
$this->assertEquals('Barry', $user->name);
}
public function test_userinfo_endpoint_jwks_response_handled()
{
$userinfoResponseData = OidcJwtHelper::idToken(['name' => 'Barry Jwks']);