-
-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix including interval in response of device authorization request #1410
base: master
Are you sure you want to change the base?
Fix including interval in response of device authorization request #1410
Conversation
@hafezdivandari apologies I've not forgotten about this. My partner is sick just now and my son has a sickness bug so I have little time but will get to it as soon as she is better. Apologies for the delay. Just wanted to give you an update |
@Sephster No worries at all! Take all the time you need. I hope your family feels better soon. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for this Hafez. I think there are some bugs that have been fixed here that aren't actual bugs. I'll try to outline them as best I can below:
- Fix typo is grand. Thank you!
- For a long time I debated whether to have a "setIntervalVisibility" function. Intially I just thought we could have the default as five and if you wanted to increase or decrease this, you could set the value to something different and we'd then report it in the response as the absence of it implies 5 seconds anyway. I think this is probably why the code is the way it is now but appreciate it is confusing to set visibility and then have it do nothing. I think the easiest fix here is to change the condition that adds the interval to the response to check for if the interval visibility has been set, which should be non-breaking.
- I think it is correct to not record a new poll date if we issue a slowdown. The slowdown message just informs the client they've polled too quickly. If we logged the poll date, we'd reset the timer to 5 second again which we don't want to do.
- The interval increase of five is supposed to be followed by the client, not enforced by the server so we shouldn't need to make a change here as far as I'm aware
- Can you highlight where the issue is with us returning a slow_down after the request has been approved? I wasn't too clear where this was happening
- Because we don't need to change the interval, we shouldn't need to report new interval values so don't need to include these in the error response, and can hopefully avoid these breaking changes
Hope all this makes sense but I think we probably only need to fix the visibility honouring and the typo. Cheers for all your work on this!
@Sephster I've applied the requested changes, please review again. |
This PR does:
DeviceCodeRepositoryInterface::getDeviceCodeEntityByDeviceCode()
argument,string $deviceCodeEntity
->string $deviceCode
.$grant->setIntervalVisibility(true)
the response still doesn't includeinterval
. On the response you are excludinginterval
when it's set to default 5. Although the server may use the default interval value, we still want to include theinternal
on the response.slow_down
error happens, because the exception is thrown before callingpersistDeviceCode
.Increase interval by 5 whenslow_down
error happens according to section 3.5 of RFC8628.slow_down
error response may have been returned even after the user has completed the auth flow (already approved / denied the request).Include theinterval
value onauthorization_pending
andslow_down
error responses.