pixelfed

Commit Graph

Author	SHA1	Message	Date
Daniel Supernault	26887c7672	Update OIDC config with comments, and disable tests as we dont have db tests configured	1 year ago
Gavin Mogan	70584b47c5	Fixes for items highlighted by review.ai * Consider using `hash_equals()` instead of `==` when comparing the state values to prevent timing attacks: `abort_unless(hash_equals($request->input('state'), $request->session()->pull('oauth2state')), 400, 'invalid state');` * For better data integrity, consider adding a foreign key constraint to the user_id column: `$table- >foreign('user_id')->references('id')->on('users')->onDelete('cascade');` * Does the OIDC provider guarantee that the username field exists in the userInfo data? Consider adding a null check or fallback: `$userInfoData[config('remote-auth.oidc.field_username')] ?? null`	1 year ago
Gavin Mogan	441c8e0d4c	Generic OIDC Support * Everything should be configurable by env variables * Basic request tests	1 year ago

Author

SHA1

Message

Date

Daniel Supernault

26887c7672

Update OIDC config with comments, and disable tests as we dont have db tests configured

Gavin Mogan

70584b47c5

Fixes for items highlighted by review.ai

* Consider using `hash_equals()` instead of `==` when comparing the state values to prevent timing attacks:
`abort_unless(hash_equals($request->input('state'), $request->session()->pull('oauth2state')), 400, 'invalid
state');`
* For better data integrity, consider adding a foreign key constraint to the user_id column: `$table-
>foreign('user_id')->references('id')->on('users')->onDelete('cascade');`
* Does the OIDC provider guarantee that the username field exists in the userInfo data? Consider adding a
null check or fallback: `$userInfoData[config('remote-auth.oidc.field_username')] ?? null`

Gavin Mogan

441c8e0d4c

Generic OIDC Support

* Everything should be configurable by env variables
* Basic request tests

3 Commits (ae47ba73d65d06aa607a6f416862b2c1a74de2cd)