Repository: auth0/auth0.js
Pull request #609 (2017-12-29 13:18:07)

Throw an error if checksession is called with responseType:code


Patch:
diff --git a/README.md b/README.md
index 062274c..0124fd1 100644
--- a/README.md
+++ b/README.md
@@ -108,6 +108,8 @@ The contents of `authResult` are identical to those returned by `parseHash()`.
 
 > **Important:** If you're not using the hosted login page to do social logins, you have to use your own [social connection keys](https://manage.auth0.com/#/connections/social). If you use Auth0's dev keys, you'll always get `login_required` as an error when calling `checkSession`.
 
+> **Important:** Because there is no redirect in this method, `responseType: 'code'` is not supported and will throw an error.
+
 Remember to add the URL where the authorization request originates from, to the Allowed Web Origins list of your Auth0 client in the [Dashboard](https://manage.auth0.com/) under your client's **Settings**.
 
 - **client.login(options, callback)**: Authenticates a user with username and password in a realm using `/oauth/token`. This will not initialize a SSO session at Auth0, hence can not be used along with silent authentication.
diff --git a/src/web-auth/index.js b/src/web-auth/index.js
index 2a06695..23c794c 100644
--- a/src/web-auth/index.js
+++ b/src/web-auth/index.js
@@ -386,6 +386,10 @@ WebAuth.prototype.checkSession = function(options, cb) {
     ])
     .with(options);
 
+  if (params.responseType === 'code') {
+    return cb(new Error("responseType can't be `code`"));
+  }
+
   if (!options.nonce) {
     params = this.transactionManager.process(params);
   }


Test patch:
diff --git a/test/web-auth/web-auth.test.js b/test/web-auth/web-auth.test.js
index f4e41a2..f74ef4d 100644
--- a/test/web-auth/web-auth.test.js
+++ b/test/web-auth/web-auth.test.js
@@ -473,7 +473,9 @@ describe('auth0.WebAuth', function() {
         });
       });
 
-      it('should parse a valid hash from the location.hash even if transaction is null but state & nonce passed as parameters', function(done) {
+      it('should parse a valid hash from the location.hash even if transaction is null but state & nonce passed as parameters', function(
+        done
+      ) {
         var webAuth = new WebAuth({
           domain: 'wptest.auth0.com',
           redirectUri: 'http://example.com/callback',
@@ -487,31 +489,38 @@ describe('auth0.WebAuth', function() {
           return null;
         });
 
-        var data = webAuth.parseHash({ nonce: 'asfd', state:'123', hash: '#state=123&access_token=asldkfjahsdlkfjhasd&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IlF6RTROMFpCTTBWRFF6RTJSVVUwTnpJMVF6WTFNelE0UVRrMU16QXdNRUk0UkRneE56RTRSZyJ9.eyJpc3MiOiJodHRwczovL3dwdGVzdC5hdXRoMC5jb20vIiwic3ViIjoiYXV0aDB8NTVkNDhjNTdkNWIwYWQwMjIzYzQwOGQ3IiwiYXVkIjoiZ1lTTmxVNFlDNFYxWVBkcXE4elBRY3VwNnJKdzFNYnQiLCJleHAiOjE0ODI5NjkwMzEsImlhdCI6MTQ4MjkzMzAzMSwibm9uY2UiOiJhc2ZkIn0.PPoh-pITcZ8qbF5l5rMZwXiwk5efbESuqZ0IfMUcamB6jdgLwTxq-HpOT_x5q6-sO1PBHchpSo1WHeDYMlRrOFd9bh741sUuBuXdPQZ3Zb0i2sNOAC2RFB1E11mZn7uNvVPGdPTg-Y5xppz30GSXoOJLbeBszfrVDCmPhpHKGGMPL1N6HV-3EEF77L34YNAi2JQ-b70nFK_dnYmmv0cYTGUxtGTHkl64UEDLi3u7bV-kbGky3iOOCzXKzDDY6BBKpCRTc2KlbrkO2A2PuDn27WVv1QCNEFHvJN7HxiDDzXOsaUmjrQ3sfrHhzD7S9BcCRkekRfD9g95SKD5J0Fj8NA&token_type=Bearer&refresh_token=kajshdgfkasdjhgfas' }, function(err, data) {
-          expect(err).to.be(null);
-          expect(data).to.eql({
-            accessToken: 'asldkfjahsdlkfjhasd',
-            idToken: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IlF6RTROMFpCTTBWRFF6RTJSVVUwTnpJMVF6WTFNelE0UVRrMU16QXdNRUk0UkRneE56RTRSZyJ9.eyJpc3MiOiJodHRwczovL3dwdGVzdC5hdXRoMC5jb20vIiwic3ViIjoiYXV0aDB8NTVkNDhjNTdkNWIwYWQwMjIzYzQwOGQ3IiwiYXVkIjoiZ1lTTmxVNFlDNFYxWVBkcXE4elBRY3VwNnJKdzFNYnQiLCJleHAiOjE0ODI5NjkwMzEsImlhdCI6MTQ4MjkzMzAzMSwibm9uY2UiOiJhc2ZkIn0.PPoh-pITcZ8qbF5l5rMZwXiwk5efbESuqZ0IfMUcamB6jdgLwTxq-HpOT_x5q6-sO1PBHchpSo1WHeDYMlRrOFd9bh741sUuBuXdPQZ3Zb0i2sNOAC2RFB1E11mZn7uNvVPGdPTg-Y5xppz30GSXoOJLbeBszfrVDCmPhpHKGGMPL1N6HV-3EEF77L34YNAi2JQ-b70nFK_dnYmmv0cYTGUxtGTHkl64UEDLi3u7bV-kbGky3iOOCzXKzDDY6BBKpCRTc2KlbrkO2A2PuDn27WVv1QCNEFHvJN7HxiDDzXOsaUmjrQ3sfrHhzD7S9BcCRkekRfD9g95SKD5J0Fj8NA',
-            idTokenPayload: {
-              iss: 'https://wptest.auth0.com/',
-              sub: 'auth0|55d48c57d5b0ad0223c408d7',
-              aud: 'gYSNlU4YC4V1YPdqq8zPQcup6rJw1Mbt',
-              exp: 1482969031,
-              iat: 1482933031,
-              nonce: 'asfd'
-            },
-            appState: '123',
-            refreshToken: 'kajshdgfkasdjhgfas',
+        var data = webAuth.parseHash(
+          {
+            nonce: 'asfd',
             state: '123',
-            expiresIn: null,
-            tokenType: 'Bearer',
-            scope: null
-          });
+            hash: '#state=123&access_token=asldkfjahsdlkfjhasd&id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IlF6RTROMFpCTTBWRFF6RTJSVVUwTnpJMVF6WTFNelE0UVRrMU16QXdNRUk0UkRneE56RTRSZyJ9.eyJpc3MiOiJodHRwczovL3dwdGVzdC5hdXRoMC5jb20vIiwic3ViIjoiYXV0aDB8NTVkNDhjNTdkNWIwYWQwMjIzYzQwOGQ3IiwiYXVkIjoiZ1lTTmxVNFlDNFYxWVBkcXE4elBRY3VwNnJKdzFNYnQiLCJleHAiOjE0ODI5NjkwMzEsImlhdCI6MTQ4MjkzMzAzMSwibm9uY2UiOiJhc2ZkIn0.PPoh-pITcZ8qbF5l5rMZwXiwk5efbESuqZ0IfMUcamB6jdgLwTxq-HpOT_x5q6-sO1PBHchpSo1WHeDYMlRrOFd9bh741sUuBuXdPQZ3Zb0i2sNOAC2RFB1E11mZn7uNvVPGdPTg-Y5xppz30GSXoOJLbeBszfrVDCmPhpHKGGMPL1N6HV-3EEF77L34YNAi2JQ-b70nFK_dnYmmv0cYTGUxtGTHkl64UEDLi3u7bV-kbGky3iOOCzXKzDDY6BBKpCRTc2KlbrkO2A2PuDn27WVv1QCNEFHvJN7HxiDDzXOsaUmjrQ3sfrHhzD7S9BcCRkekRfD9g95SKD5J0Fj8NA&token_type=Bearer&refresh_token=kajshdgfkasdjhgfas'
+          },
+          function(err, data) {
+            expect(err).to.be(null);
+            expect(data).to.eql({
+              accessToken: 'asldkfjahsdlkfjhasd',
+              idToken: 'eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IlF6RTROMFpCTTBWRFF6RTJSVVUwTnpJMVF6WTFNelE0UVRrMU16QXdNRUk0UkRneE56RTRSZyJ9.eyJpc3MiOiJodHRwczovL3dwdGVzdC5hdXRoMC5jb20vIiwic3ViIjoiYXV0aDB8NTVkNDhjNTdkNWIwYWQwMjIzYzQwOGQ3IiwiYXVkIjoiZ1lTTmxVNFlDNFYxWVBkcXE4elBRY3VwNnJKdzFNYnQiLCJleHAiOjE0ODI5NjkwMzEsImlhdCI6MTQ4MjkzMzAzMSwibm9uY2UiOiJhc2ZkIn0.PPoh-pITcZ8qbF5l5rMZwXiwk5efbESuqZ0IfMUcamB6jdgLwTxq-HpOT_x5q6-sO1PBHchpSo1WHeDYMlRrOFd9bh741sUuBuXdPQZ3Zb0i2sNOAC2RFB1E11mZn7uNvVPGdPTg-Y5xppz30GSXoOJLbeBszfrVDCmPhpHKGGMPL1N6HV-3EEF77L34YNAi2JQ-b70nFK_dnYmmv0cYTGUxtGTHkl64UEDLi3u7bV-kbGky3iOOCzXKzDDY6BBKpCRTc2KlbrkO2A2PuDn27WVv1QCNEFHvJN7HxiDDzXOsaUmjrQ3sfrHhzD7S9BcCRkekRfD9g95SKD5J0Fj8NA',
+              idTokenPayload: {
+                iss: 'https://wptest.auth0.com/',
+                sub: 'auth0|55d48c57d5b0ad0223c408d7',
+                aud: 'gYSNlU4YC4V1YPdqq8zPQcup6rJw1Mbt',
+                exp: 1482969031,
+                iat: 1482933031,
+                nonce: 'asfd'
+              },
+              appState: '123',
+              refreshToken: 'kajshdgfkasdjhgfas',
+              state: '123',
+              expiresIn: null,
+              tokenType: 'Bearer',
+              scope: null
+            });
 
-          expect(TransactionManager.prototype.getStoredTransaction.calledOnce).to.be.ok();
+            expect(TransactionManager.prototype.getStoredTransaction.calledOnce).to.be.ok();
 
-          done();
-        });
+            done();
+          }
+        );
       });
 
       it('should fail with an invalid state (null transaction)', function(done) {
@@ -1615,6 +1624,11 @@ describe('auth0.WebAuth', function() {
         WebAuth.prototype.validateAuthenticationResponse.restore();
       }
     });
+    it('throws an error if responseType is code', function() {
+      this.auth0.checkSession({ responseType: 'code' }, function(err) {
+        expect(err.message).to.be.eql("responseType can't be `code`");
+      });
+    });
     it('inits IframeHandler with correct params', function(done) {
       stub(IframeHandler.prototype, 'init', function() {
         expect(this.url).to.be(