You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Calling code may want to know when calls to @redis.get or @redis.set fail. For example, in this code, err should be handled when @redis.get fails, perhaps because the redis client can't connect to the redis instance. And then despite this comment, I think you actually want to know when that write failed - otherwise, you're vulnerable to replay attacks.
I'm happy to submit a PR for this, just want to make sure you guys are ok with the architectural ideas above. I guess, technically, it's kind of a breaking change if people are relying on "Expired nonce" even when its not?
The text was updated successfully, but these errors were encountered:
Calling code may want to know when calls to
@redis.get
or@redis.set
fail. For example, in this code,err
should be handled when@redis.get
fails, perhaps because the redis client can't connect to the redis instance. And then despite this comment, I think you actually want to know when that write failed - otherwise, you're vulnerable to replay attacks.Additionally, this code currently treats all nonceStore errors from
@nonceStore.isNew
in _valid_oauth as an "Expired nonce," which may not be the case if it can error out for other reasons (i.e. a call to@redis.get
failed). It looks like you already have a StoreError, so you could use that inRedisNonceStore.isNew
and then switch on the error type in the@nonceStore.isNew
callback to determine which error to send to the nextcallback
and ultimately up to the calling code.I'm happy to submit a PR for this, just want to make sure you guys are ok with the architectural ideas above. I guess, technically, it's kind of a breaking change if people are relying on "Expired nonce" even when its not?
The text was updated successfully, but these errors were encountered: