ciaranj/connect-auth — Issue #83: Previous request token checking in oauth strategy doesn't work
Author: xentac
Created: 2012-02-28 18:48:21+00:00
State: open

Right now the code looks like this:

self.provider.previousRequestToken(requestParameters['oauth_consumer_key'], function(err, result) {

But previousRequestToken in the example provider looks like this:

OAuthDataProvider.prototype.previousRequestToken = function(token, callback) {
for(var key in this.oauth_previous_users_request_tokens) {
if( this.oauth_previous_users_request_tokens[key] && this.oauth_previous_users_request_tokens[key].token == token ) {
callback(new Error("Previously used token"));
return;
}
}
callback(null, token);
}

It's checking the value of token, which definitely is not the oauth_consumer_key, it's the oauth_token. The code on line 89 of _oauthservices.js needs to use oauth_token otherwise people could resubmit request tokens for access token generation.