whs-authz-authn/caido-plugin-test
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[Update] oauth 탐지 로직 정교화

Browse source
This commit is contained in:
tv0924@icloud.com 2025-06-02 10:50:11 +09:00
commit b8b7edb5ac
4 changed files with 180 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

22
packages/backend/src/index.ts
View file

@ -6,17 +6,15 @@ import { CsrfCheck } from "./controller/csrfCheck";
import { PKCECheck } from "./controller/PKCECheck";
import { AccessTokenLeakController } from "./controller/accessTokenDetector";
import { ScopeDetection } from "./controller/scopeDetection";
import { NonceCheckController } from "./controller/nonceCheck";
// import { NonceCheckController } from "./controller/nonceCheck";
export type API = DefineAPI<{}>;
const csrfCheck = new CsrfCheck();
// const implicitGrantController = new ImplicitGrantController();
// const authZCodeGrantController = new AuthZCodeGrantController();
const pkceCheckController = new PKCECheck();
const tokenCheck = new AccessTokenLeakController();
const ScopeDetectionController = new ScopeDetection();
const nonceCheckController = new NonceCheckController();
// const nonceCheckController = new NonceCheckController();
export function init(sdk: SDK<API>) {
sdk.events.onInterceptResponse(async (sdk, req: Request, res: Response) => {
@ -26,14 +24,14 @@ export function init(sdk: SDK<API>) {
await tokenCheck.testResp(sdk, res, req);
await ScopeDetectionController.scan(sdk, req.getUrl());
if (NonceCheckController.isOidcFlow(req, res)) {
await sdk.findings.create({
title: "OIDC Flow Detected",
description: "The request appears to be part of an OIDC flow.",
request: req,
reporter: "",
});
}
// if (NonceCheckController.isOidcFlow(req, res)) {
// await sdk.findings.create({
// title: "OIDC Flow Detected",
// description: "The request appears to be part of an OIDC flow.",
// request: req,
// reporter: "",
// });
// }
});
/*