An example implementation of an AT Protocol (BlueSky) OAuth client
by pilcrowonpaperTypeScript
Last 12 weeks · 0 commits
2 of 6 standards met
Hello there, Thank you for your example, I managed to run it, and I managed to turn it to SvelteKit. _(I mean to arrive to a point where I see the handle)_ Could you explain a bit more: The role of ? What would you save to then be able to F5 and keep beeing connected ? Souldn't you remove cookies at the end of the process ? Thank you for you inputs. (not urgent ;) )
Repository: pilcrowonpaper/atproto-oauth-example. Description: An example implementation of an AT Protocol (BlueSky) OAuth client Stars: 65, Forks: 4. Primary language: TypeScript. Languages: TypeScript (94.8%), Astro (4.5%), JavaScript (0.7%). License: 0BSD. Homepage: https://atproto-oauth-example.vercel.app Open PRs: 0, open issues: 0. Last activity: 1y ago. Community health: 42%. Top contributors: pilcrowonpaper, astrobot-houston.
Fixes a major vulnerability where one could authenticate as any user. Vulnerability The app did not check if the authorization server was listed in the user's DID document in the OAuth callback step. A malicious actor could set up their own authorization server with a token endpoint that returned the DID of the user to impersonate. Fix Compare the authorization server issuer against the one listed by the user's DID document after validating the authorization code. Why did this happen? In a typical OAuth flow, the authorization server can be implicitly trusted. This is not the case when users can use their own servers and it was an embarrassing oversight on my end.