[HttpClient] Allow bearer token with colon #38248
Conversation
|
Seems like the RFC 6750 bearer format was used here: https://tools.ietf.org/html/rfc6750#section-2.1 But I see no reason to prevent any other token format here, "bearer" isn't directly coupled to OAuth2.0, right? |
| @@ -110,7 +110,7 @@ private static function prepareRequest(?string $method, ?string $url, array $opt | |||
| throw new InvalidArgumentException(sprintf('Option "auth_basic" must be string or an array, "%s" given.', \gettype($options['auth_basic']))); | |||
| } | |||
|
|
|||
| if (isset($options['auth_bearer']) && (!\is_string($options['auth_bearer']) || !preg_match('{^[-._=~+/0-9a-zA-Z]++$}', $options['auth_bearer']))) { | |||
| if (isset($options['auth_bearer']) && (!\is_string($options['auth_bearer']) || !preg_match('{^[-._=:~+/0-9a-zA-Z]++$}', $options['auth_bearer']))) { | |||
| throw new InvalidArgumentException(sprintf('Option "auth_bearer" must be a string containing only characters from the base 64 alphabet, '.(\is_string($options['auth_bearer']) ? 'invalid string given.' : '"%s" given.'), \gettype($options['auth_bearer']))); | |||
There was a problem hiding this comment.
The message should be updated. It's now the base 64 alphabet with the colon!
There was a problem hiding this comment.
reverted, no need to advertise the colon, its non-standard
|
Could you add a testcase? |
|
I think this still deserves reporting to Jetbrains that their OAuth tokens don't actually respect the OAuth stack. But we might indeed be less strict here, accepting more things that servers provide as tokens. |
|
8fb7e41 to
82ed1ec
Compare
| @@ -110,7 +110,7 @@ private static function prepareRequest(?string $method, ?string $url, array $opt | |||
| throw new InvalidArgumentException(sprintf('Option "auth_basic" must be string or an array, "%s" given.', \gettype($options['auth_basic']))); | |||
| } | |||
|
|
|||
| if (isset($options['auth_bearer']) && (!\is_string($options['auth_bearer']) || !preg_match('{^[-._=~+/0-9a-zA-Z]++$}', $options['auth_bearer']))) { | |||
| if (isset($options['auth_bearer']) && (!\is_string($options['auth_bearer']) || !preg_match('{^[-._=:~+/0-9a-zA-Z]++$}', $options['auth_bearer']))) { | |||
| throw new InvalidArgumentException(sprintf('Option "auth_bearer" must be a string containing only characters from the base 64 alphabet, '.(\is_string($options['auth_bearer']) ? 'invalid string given.' : '"%s" given.'), \gettype($options['auth_bearer']))); | |||
There was a problem hiding this comment.
reverted, no need to advertise the colon, its non-standard
|
Thank you @stephanvierkant. |
The JetBrains Hub (YouTrack API) creates tokens with a
perm:prefix. This doesn't work right now, because HttpClient doesn't allow a colon in the bearer token.As far as I can see, there is no reason to disallow the use of the semicolon in the bearer token, so this PR fixes it.
Example of a token:
perm:c3RlcGhhbg==.NTUtMw==.NiZw16agafhsQAShTvclhb78hyJh2H