This change ensures time comparisons Token expiry checking uses the wall
clock instead of the monotonic clock.
This situation can occur on laptops which enter sleep mode and don't
advance their monotonic clock.
Change-Id: If8518e96ca04f2137db4703440ff3b851d221aae
Reviewed-on: https://go-review.googlesource.com/83575
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Go 1.10 no longer sets implicit Content-Type on empty output.
Updates golang/go#20784
Change-Id: I3f13f76b94b58869481218ea2e1805f5f4175fd7
Reviewed-on: https://go-review.googlesource.com/82017
Reviewed-by: Ian Lance Taylor <iant@golang.org>
This adds 'https://login.live.com/' as a broken auth header provider.
Without this change the provider which is integrated in
golang.org/x/oauth2/microsoft isn't working correctly and returns
a "The provided value for the 'client_secret' parameter is not valid"
response from the endpoint.
Change-Id: I1887e1ad049ce37f81322de84dcddd0ce486d6e1
Reviewed-on: https://go-review.googlesource.com/78555
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
As per https://tools.ietf.org/html/rfc6749#section-2.3.1 client IDs and secrets must be urlencoded in the authorization header. This patch addresses this by wrapping clientID and clientSecret with url.QueryEscape. A dedicated test for unsafe-url client IDs and secrets has been added as well.
Closes#237
Change-Id: I1f277b52caef4932e14147be8fb1712203da51d0
Reviewed-on: https://go-review.googlesource.com/46473
Reviewed-by: JBD <jbd@google.com>
Fix the broken build and make it consistent with
the first example.
Change-Id: I7c240b826397e6ec04294a2c9de89762d68643de
Reviewed-on: https://go-review.googlesource.com/61050
Run-TryBot: JBD <jbd@google.com>
Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
- provides a bare and custom context example
demonstrating that http client attributes are
not always passed along.
- adds clarifying note to the oauth2.go NewClient
godoc.
- trim down example_test
Change-Id: Iad6697eed83429c36b9ba0efc43293f4910938fb
Reviewed-on: https://go-review.googlesource.com/36553
Run-TryBot: Ian Lance Taylor <iant@golang.org>
Reviewed-by: JBD <jbd@google.com>
Previously we described where to submit patches and report issues but
didn't have links to the right places, so let's fix that.
Change-Id: I49d9bf5f1570ba495454fa32f5fec4faa66f9667
Reviewed-on: https://go-review.googlesource.com/49851
Reviewed-by: Jaana Burcu Dogan <jbd@google.com>
Change I9cfd46787ebfb27cf2775dd3357eb26e089322a3 added
login.microsoft.net as a broken auth header provider. This was meant to
be login.windows.net. This change removes login.microsoft.net and adds
login.windows.net.
Change-Id: I6178053ab5c86b4f38996042384e1f4a139560aa
Reviewed-on: https://go-review.googlesource.com/47250
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Currently the HTTP request does not set the given context.
This change sets the context (if not nil) on the request.
Change-Id: I4bb21636d05050a68ba70ce92f9bf9ba608fbfad
Reviewed-on: https://go-review.googlesource.com/45370
Run-TryBot: Chris Broadfoot <cbro@golang.org>
Reviewed-by: Jaana Burcu Dogan <jbd@google.com>
Reviewed-by: Chris Broadfoot <cbro@golang.org>
Azure AD applications use login.microsoft.net for token URLs for OAuth
and OpenID Connect. This service expects the OAuth client ID and client
secret in the body of the OAuth exchange request.
Fixes#238
Change-Id: I9cfd46787ebfb27cf2775dd3357eb26e089322a3
Reviewed-on: https://go-review.googlesource.com/47097
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This passes right now, but it's not obvious from looking at
tokenRefresher why it works. It depends on logic in
internal.RetrieveToken. I'm working on a larger refactor, but I want to
keep the test in place to avoid future regressions from seemingly
harmless code movements.
Change-Id: I742ccb952fbc069ca0887a556e362a0e59bef79b
Reviewed-on: https://go-review.googlesource.com/43573
Reviewed-by: Jaana Burcu Dogan <jbd@google.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Shopify uses URLs in the form my-shop-id.myshopify.com as the endpoints
for its OAuth2 dances.
Change-Id: I73d98ca285991b2f73dd9d8d366d3fdbe249e741
Reviewed-on: https://go-review.googlesource.com/42630
Reviewed-by: Jaana Burcu Dogan <jbd@google.com>
Before AppEngine classic allowed "google.golang.org/appengine" imports,
we used to maintain two hook files to choose either from "appengine" or
"google.golang.org/appengine" namespaces. Now, both environments allow
importing from "google.golang.org/appengine". Therefore, there
is no need to set hooks in two separate files.
Also note that Flex prefers to use metadata server, so we still
need to be able to differentiate between these environments.
Change-Id: I7478ebdfa1b062d466aaf2aca938f93d42b4c58a
Reviewed-on: https://go-review.googlesource.com/37378
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Checked with simple application, worked good for me.
Change-Id: I068b33c1b44a338a7b0a9b17220bc39db81f2eed
Reviewed-on: https://go-review.googlesource.com/37443
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
gofmt -s -w -l does this simplification. Running gofmt when this
package is vendored causes the vendored file to be simplified.
Change-Id: I00502ff564bd5cff2614a8372db7beb1eb4519ec
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
Reviewed-on: https://go-review.googlesource.com/37013
Reviewed-by: Chris Broadfoot <cbro@golang.org>
Godoc comments should start with the name of the thing they are describing.
Change-Id: Ic248aa8f549b22c716bf967c7574452085ea8c48
Reviewed-on: https://go-review.googlesource.com/36945
Reviewed-by: Chris Broadfoot <cbro@golang.org>
CL/23790 breaks the calls to Facebook, adding Facebook
to the brokens list is reported to fix the problem.
Fixesgolang/oauth2#214.
Change-Id: I3b3440de723b4933bc49b5a52698c825affbf643
Reviewed-on: https://go-review.googlesource.com/36633
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Chris Broadfoot <cbro@golang.org>
Set the KeyID hint in the token header. This allows remote servers to
identify the key used to sign the message.
Fixes#18307
Change-Id: Ib95398079833aad6b390650b465d7b09b5f53fda
Reviewed-on: https://go-review.googlesource.com/34320
Reviewed-by: Jaana Burcu Dogan <jbd@google.com>
Due to an issue in handling thread-local storages, os/user can lead to SEGV
when glibc is statically linked with.
So we prefer os.Getenv("HOME") for guessing where is the home directory.
See also: golang/go#13470
Change-Id: I1046ff93a71aa3b11299f7e6cf65ff7b1fb07eb9
Reviewed-on: https://go-review.googlesource.com/34175
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This new function allows reading the project ID from a service account
JSON file without an additional disk read.
Change-Id: I1f03ca3ca39a2ae3bd6524367c17761b0f08de45
Reviewed-on: https://go-review.googlesource.com/32876
Reviewed-by: Jaana Burcu Dogan <jbd@google.com>
The ADC code and the JWT-parsing function operate on the same data
format, but were using separate code paths, each of which was missing
things from the other.
While this presents no change in API surface, JWTConfigFromJSON now
strictly checks the "type" field in the JSON file before building a
config.
Change-Id: I2f593a16bf4591059fbf9002bccea06e41e5e161
Reviewed-on: https://go-review.googlesource.com/32678
Reviewed-by: Jaana Burcu Dogan <jbd@google.com>
A change introduced in https://golang.org/cl/18692 expanded upon the errors
returned by the json package to be more informative about where the error occurred.
This breaks a test in oauth2 that relies on the exact form that an error takes.
Fix this test by simply checking whether it passes or not.
Fixesgolang/go#17363
Updates golang/go#11811
Change-Id: I0062dc64fc1a8fd094b14ed1d0b21528edfbb282
Reviewed-on: https://go-review.googlesource.com/30600
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
There is not a good way of autogenerating the style fixes, hence I am
manually fixing them in small chunks.
Change-Id: I1fee5956dae93f38b8f1e7460b74d3d96e7ccd2c
Reviewed-on: https://go-review.googlesource.com/27922
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Little detail that makes it easier to find the link to godoc.
Change-Id: Ic3fb467ae23bce3cc2e3801d78221a4187be4462
Reviewed-on: https://go-review.googlesource.com/27915
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This package is not a general-use JWS implementation and should live
under internal. For now, just add a warning that no new users should
depend on it.
Updates #196.
Change-Id: I0eef273c8327a5ad26eb33a4425afcadca23494b
Reviewed-on: https://go-review.googlesource.com/27692
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
There is no good reason why we suggest NoContext rather than
context.Background(). When the oauth2 library first came around, the
community was not familiar with the x/net/context package. For
documentation reasons, we decided to add NoContext to the oauth2
package. It was not a good idea even back then. And given that context
package is fairly popular, there is no good reason why we are
depending on this.
Updating all the references of NoContext with context.Background
and documenting it as deprecated.
Change-Id: I18e390f1351023a29b567777a3f963dd550cf657
Reviewed-on: https://go-review.googlesource.com/27690
Reviewed-by: Chris Broadfoot <cbro@golang.org>
Vladimir Varankin
Elena Grahovac
Blake Mesdag
JBD
Anthony Alves
Brad Fitzpatrick
Max Schmitt
Tim Cooper
Aeneas Rekkas (arekkas)
zachgersh
Ross Light
Kevin Burke
voutasaurus
Bastian Ike
Martin Hoefling
Dave Day
Eric Chiang
Richard Musiol
Sergey Mishin
Ahmet Alp Balkan
Pablo Lalloni
Tristan Colgate
Akihiro Suda
Marin
Joseph Anthony Pasquale Holsten
Gareth Paul Jones
Joe Tsai