Repository: auth0/auth0.js
Pull request #386 (2017-03-12 22:45:40)

Whitelist resource owner parameters


Patch:
diff --git a/src/authentication/index.js b/src/authentication/index.js
index 9abfb11..d8c0848 100644
--- a/src/authentication/index.js
+++ b/src/authentication/index.js
@@ -264,7 +264,7 @@ Authentication.prototype.loginWithResourceOwner = function (options, cb) {
     'clientID',
     'scope',
     'audience'
-  ]).with(options);
+  ]).with(options, ['username', 'password', 'scope', 'connection', 'device']);
 
   body = objectHelper.toSnakeCase(body, ['auth0Client']);
 


Test patch:
diff --git a/test/authentication/authentication.test.js b/test/authentication/authentication.test.js
index 10130e5..0a57e3d 100644
--- a/test/authentication/authentication.test.js
+++ b/test/authentication/authentication.test.js
@@ -6,8 +6,8 @@ var RequestMock = require('../mock/request-mock');
 
 var request = require('superagent');
 
-var RequestBuilder = require('../../src/helper/request-builder')
-var Authentication = require('../../src/authentication')
+var RequestBuilder = require('../../src/helper/request-builder');
+var Authentication = require('../../src/authentication');
 
 var telemetryInfo = (new RequestBuilder({})).getTelemetryData();
 
@@ -20,7 +20,7 @@ describe('auth0.authentication', function () {
       }).to.throwException(function (e) {
         expect(e.message).to.be('options parameter is not valid');
       });
-    })
+    });
 
     it('should check that domain is set', function() {
       expect(function() {
@@ -28,7 +28,7 @@ describe('auth0.authentication', function () {
       }).to.throwException(function (e) {
         expect(e.message).to.be('domain option is required');
       });
-    })
+    });
 
     it('should check that clientID is set', function() {
       expect(function() {
@@ -36,8 +36,8 @@ describe('auth0.authentication', function () {
       }).to.throwException(function (e) {
         expect(e.message).to.be('clientID option is required');
       });
-    })
-  })
+    });
+  });
 
   context('buildAuthorizeUrl', function () {
 
@@ -57,13 +57,13 @@ describe('auth0.authentication', function () {
       }).to.throwException(function (e) {
         expect(e.message).to.be('options parameter is not valid');
       });
-    })
+    });
 
     it('should return a url using the default settings', function() {
       var url = this.auth0.buildAuthorizeUrl({state:'1234'});
 
       expect(url).to.be('https://me.auth0.com/authorize?client_id=...&response_type=code&redirect_uri=http%3A%2F%2Fpage.com%2Fcallback&state=1234');
-    })
+    });
 
     it('should return a url with connection_scope', function() {
       var url = this.auth0.buildAuthorizeUrl({
@@ -75,7 +75,7 @@ describe('auth0.authentication', function () {
       });
 
       expect(url).to.be('https://me.auth0.com/authorize?client_id=...&response_type=token&redirect_uri=http%3A%2F%2Fanotherpage.com%2Fcallback2&prompt=none&state=1234&connection_scope=scope1%2Cscope2');
-    })
+    });
 
     it('should return a url with connection_scope as a string', function() {
       var url = this.auth0.buildAuthorizeUrl({
@@ -87,7 +87,7 @@ describe('auth0.authentication', function () {
       });
 
       expect(url).to.be('https://me.auth0.com/authorize?client_id=...&response_type=token&redirect_uri=http%3A%2F%2Fanotherpage.com%2Fcallback2&prompt=none&state=1234&connection_scope=scope1%2Cscope2');
-    })
+    });
 
     it('should return a url using overriding the default settings', function() {
       var url = this.auth0.buildAuthorizeUrl({
@@ -98,7 +98,7 @@ describe('auth0.authentication', function () {
       });
 
       expect(url).to.be('https://me.auth0.com/authorize?client_id=...&response_type=token&redirect_uri=http%3A%2F%2Fanotherpage.com%2Fcallback2&prompt=none&state=1234');
-    })
+    });
 
     it('should return a url using using whitelisted authorization parameter device', function() {
       var url = this.auth0.buildAuthorizeUrl({
@@ -110,8 +110,8 @@ describe('auth0.authentication', function () {
       });
 
       expect(url).to.be('https://me.auth0.com/authorize?client_id=...&response_type=token&redirect_uri=http%3A%2F%2Fanotherpage.com%2Fcallback2&prompt=none&state=1234&device=my-device');
-    })
-  })
+    });
+  });
 
   context('buildAuthorizeUrl with Telemetry', function () {
     before(function() {
@@ -132,8 +132,8 @@ describe('auth0.authentication', function () {
       });
 
       expect(url).to.be('https://me.auth0.com/authorize?client_id=...&response_type=token&redirect_uri=http%3A%2F%2Fanotherpage.com%2Fcallback2&prompt=none&state=1234&auth0Client='+ encodeURIComponent(telemetryInfo));
-    })
-  })
+    });
+  });
 
   context('buildLogoutUrl', function () {
 
@@ -153,21 +153,21 @@ describe('auth0.authentication', function () {
       }).to.throwException(function (e) {
         expect(e.message).to.be('options parameter is not valid');
       });
-    })
+    });
 
     it('should return a url using the default settings', function() {
       var url = this.auth0.buildLogoutUrl();
 
       expect(url).to.be('https://me.auth0.com/v2/logout?client_id=...');
-    })
+    });
 
     it('should ignore the clientID', function() {
       var url = this.auth0.buildLogoutUrl({
-        clientID: undefined,
+        clientID: undefined
       });
 
       expect(url).to.be('https://me.auth0.com/v2/logout?');
-    })
+    });
 
     it('should return a url using overriding the default settings', function() {
       var url = this.auth0.buildLogoutUrl({
@@ -177,8 +177,8 @@ describe('auth0.authentication', function () {
       });
 
       expect(url).to.be('https://me.auth0.com/v2/logout?client_id=123&returnTo=http%3A%2F%2Fpage.com&federated=');
-    })
-  })
+    });
+  });
 
   context('buildLogoutUrl with Telemetry', function () {
     before(function() {
@@ -198,8 +198,8 @@ describe('auth0.authentication', function () {
       });
 
       expect(url).to.be('https://me.auth0.com/v2/logout?client_id=123&returnTo=http%3A%2F%2Fpage.com&federated=&auth0Client=' + encodeURIComponent(telemetryInfo));
-    })
-  })
+    });
+  });
 
   context('userInfo', function () {
     before(function() {
@@ -214,11 +214,11 @@ describe('auth0.authentication', function () {
 
     afterEach(function(){
       request.get.restore();
-    })
+    });
 
     it('should call userinfo with the access token', function(done) {
       stub(request, 'get', function(url) {
-        expect(url).to.be('https://me.auth0.com/userinfo')
+        expect(url).to.be('https://me.auth0.com/userinfo');
         return new RequestMock({
           headers: {
             'Content-Type': 'application/json',
@@ -246,7 +246,7 @@ describe('auth0.authentication', function () {
           is_social: false
         });
         done();
-      })
+      });
     });
   });
 
@@ -263,11 +263,11 @@ describe('auth0.authentication', function () {
 
     afterEach(function(){
       request.post.restore();
-    })
+    });
 
     it('should call delegation with all the options', function(done) {
       stub(request, 'post', function(url) {
-        expect(url).to.be('https://me.auth0.com/delegation')
+        expect(url).to.be('https://me.auth0.com/delegation');
         return new RequestMock({
           body: {
             client_id: '...',
@@ -302,7 +302,7 @@ describe('auth0.authentication', function () {
           'idToken': 'eyJ...'
         });
         done();
-      })
+      });
     });
   });
 
@@ -319,7 +319,7 @@ describe('auth0.authentication', function () {
 
     afterEach(function(){
       this.auth0.oauthToken.restore();
-    })
+    });
 
     it('should call oauthToken with all the options', function(done) {
       stub(this.auth0, 'oauthToken', function(options, cb) {
@@ -327,7 +327,7 @@ describe('auth0.authentication', function () {
           username: 'someUsername',
           password: '123456',
           grantType: 'password'
-        })
+        });
         cb();
       });
 
@@ -336,7 +336,7 @@ describe('auth0.authentication', function () {
         password: '123456'
       }, function(err, data) {
         done();
-      })
+      });
     });
 
     it('should call oauthToken with all the options', function(done) {
@@ -346,7 +346,7 @@ describe('auth0.authentication', function () {
           password: '123456',
           grantType: 'http://auth0.com/oauth/grant-type/password-realm',
           realm: 'pepe.com'
-        })
+        });
         cb();
       });
 
@@ -356,7 +356,7 @@ describe('auth0.authentication', function () {
         realm: 'pepe.com'
       }, function(err, data) {
         done();
-      })
+      });
     });
   });
 
@@ -373,11 +373,11 @@ describe('auth0.authentication', function () {
 
     afterEach(function(){
       request.post.restore();
-    })
+    });
 
     it('should allow to login', function(done) {
       stub(request, 'post', function(url) {
-        expect(url).to.be('https://me.auth0.com/oauth/token')
+        expect(url).to.be('https://me.auth0.com/oauth/token');
         return new RequestMock({
           body: {
             client_id: '...',
@@ -430,11 +430,11 @@ describe('auth0.authentication', function () {
 
     afterEach(function(){
       request.get.restore();
-    })
+    });
 
     it('should return the user country code', function(done) {
       stub(request, 'get', function(url) {
-        expect(url).to.be('https://me.auth0.com/user/geoloc/country')
+        expect(url).to.be('https://me.auth0.com/user/geoloc/country');
         return new RequestMock({
           headers: {
             'Content-Type': 'application/json'
@@ -455,7 +455,7 @@ describe('auth0.authentication', function () {
           countryCode: 'AR'
         });
         done();
-      })
+      });
     });
 
   });
@@ -473,11 +473,11 @@ describe('auth0.authentication', function () {
 
     afterEach(function(){
       request.get.restore();
-    })
+    });
 
     it('should call ssodata with all the options', function(done) {
       stub(request, 'get', function(url) {
-        expect(url).to.be('https://me.auth0.com/user/ssodata/')
+        expect(url).to.be('https://me.auth0.com/user/ssodata/');
         return new RequestMock({
           headers: {},
           cb: function(cb) {
@@ -496,7 +496,7 @@ describe('auth0.authentication', function () {
           sso:false
         });
         done();
-      })
+      });
     });
   });
 
@@ -513,11 +513,11 @@ describe('auth0.authentication', function () {
 
     afterEach(function(){
       request.get.restore();
-    })
+    });
 
     it('should call ssodata with all the ad options', function(done) {
       stub(request, 'get', function(url) {
-        expect(url).to.be('https://me.auth0.com/user/ssodata?ldaps=1&client_id=...')
+        expect(url).to.be('https://me.auth0.com/user/ssodata?ldaps=1&client_id=...');
         return new RequestMock({
           headers: {},
           cb: function(cb) {
@@ -536,8 +536,8 @@ describe('auth0.authentication', function () {
           sso:false
         });
         done();
-      })
+      });
     });
   });
 
-})
+});
diff --git a/test/authentication/ro.test.js b/test/authentication/ro.test.js
index 7d0b22f..41cd64a 100644
--- a/test/authentication/ro.test.js
+++ b/test/authentication/ro.test.js
@@ -115,7 +115,7 @@ describe('auth0.authentication', function () {
         expect(url).to.be('https://me.auth0.com/oauth/ro');
         return new RequestMock({
           body: {
-            client_id: '123',
+            client_id: '...',
             grant_type: 'password',
             username: 'the username',
             password: 'the password',
@@ -139,7 +139,6 @@ describe('auth0.authentication', function () {
       });
 
       this.auth0.loginWithResourceOwner({
-        clientID: '123',
         username: 'the username',
         password: 'the password',
         connection: 'the_connection',
@@ -154,5 +153,48 @@ describe('auth0.authentication', function () {
         done();
       });
     });
+
+    it('should exclude parameters not in whitelist', function (done) {
+      stub(request, 'post', function (url) {
+        expect(url).to.be('https://me.auth0.com/oauth/ro');
+        return new RequestMock({
+          body: {
+            client_id: '...',
+            grant_type: 'password',
+            username: 'the username',
+            password: 'the password',
+            connection: 'the_connection'
+          },
+          headers: {
+            'Content-Type': 'application/json',
+            'Auth0-Client': telemetryInfo
+          },
+          cb: function (cb) {
+            cb(null, {
+              body: {
+                id_token: 'id_token.id_token.id_token',
+                access_token: 'access_token',
+                token_type: 'bearer'
+              }
+            });
+          }
+        });
+      });
+
+      this.auth0.loginWithResourceOwner({
+        username: 'the username',
+        password: 'the password',
+        connection: 'the_connection',
+        should_ignore: { invalid: 'invalid value' }
+      }, function (err, data) {
+        expect(err).to.be(null);
+        expect(data).to.eql({
+          idToken: 'id_token.id_token.id_token',
+          accessToken: 'access_token',
+          tokenType: 'bearer'
+        });
+        done();
+      });
+    });
   });
 });