whs-authz-authn/oauth-backend
1
0
Fork 0
mirror of https://github.com/j93es/oauth-backend.git synced 2026-06-04 06:31:51 +09:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #22 from j93es/0702-1

Browse source 
[Update] 검증 진행 로직 변경 및 csrf 로직 변경
This commit is contained in:
암냥 2025-07-02 23:10:01 +09:00 • committed by GitHub
commit c8815f3f28
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 8 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.env
View file

@ -1,2 +1,2 @@
# Google OAuth 설정
GOOGLE_ID=whs.imnya.ng@gmail.com
GOOGLE_ID=oauth.j93es@gmail.com

2
addon/csrf_check.py
View file

@ -9,7 +9,7 @@ from lib.utils.is_oauth_uri import is_oauth_uri
class CsrfChecker:
nonce_params = {
"state", "nonce", "as", "frame_id", "csrf_token", "csrf"
"state", "nonce", "csrf_token", "csrf"
}
def get_header(self, headers: http.Headers, name: str) -> Optional[str]:

8
addon/init.py
View file

@ -38,6 +38,8 @@ class AddonBase:
".googlesyndication.com",
"cdn.jsdelivr.net",
"update.googleapis.com",
".google-analytics.com",
".gstatic.com"
]
# Ignore .googleapis.com domains
for domain in ignore_domains:
@ -62,11 +64,13 @@ class AddonBase:
async def request(self, flow: http.HTTPFlow):
if false_true_varifing_task.is_verifing_false_true() or self.should_ignore(flow):
if self.google_login_hint:
await try_catch(self.google_login_hint.request(flow))
if false_true_varifing_task.is_verifing_false_true():
return
tasks = [
try_catch(self.google_login_hint.request(flow)) if self.google_login_hint else None,
try_catch(PKCEDowngradeChecker().test(flow)),
]
await asyncio.gather(*tasks)