Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Not possible to have V1 and V2 clients at the same time #60

Closed
psteininger opened this issue Apr 12, 2016 · 2 comments
Closed

Not possible to have V1 and V2 clients at the same time #60

psteininger opened this issue Apr 12, 2016 · 2 comments

Comments

@psteininger
Copy link

Apparently header information is being clobbered between 2 separate instances of clients.

I need V2 client for user management, and V1 client to generate impersonation links.
When I have this:

Rails.application.auth0_api_client = Auth0Client.new(
    :api_version => 2,
    :token => ENV['AUTH0_JWT_TOKEN'],
    :domain => ENV['AUTH0_DOMAIN']
)

Rails.application.auth0_auth_client = Auth0Client.new(
    :api_version => 1,
    :domain => ENV['AUTH0_DOMAIN'],
    :client_id => ENV['AUTH0_API_KEY'],
    :client_secret => ENV['AUTH0_API_SECRET']
)

Rails.application.auth0_api_client acts as if it was the latter. This is potentially a security issue, on top of not allowing us to manage users and provide a link to impersonate. At the root of this issue is that V2 JWT token does not work with impersonation API, which should be in V2 afterall.

@psteininger
Copy link
Author

The issue stems from using HTTParty class method headers. The headers should have been isolated to an instance variable and added in perform_request.
I have a VERY hacky workaround, but it works. Since the headers are set at class level, it's easy to create 2 subclasses of the Auth0Client and use them to create instances.

class Auth0ClientV2 < Auth0Client; end
class Auth0ClientV1 < Auth0Client; end

Rails.application.auth0_api_client = Auth0ClientV2.new(
    :api_version => 2,
    :token => ENV['AUTH0_JWT_TOKEN'],
    :domain => ENV['AUTH0_DOMAIN']
)

Rails.application.auth0_auth_client = Auth0ClientV1.new(
    :api_version => 1,
    :domain => ENV['AUTH0_DOMAIN'],
    :client_id => ENV['AUTH0_API_KEY'],
    :client_secret => ENV['AUTH0_API_SECRET']
)

@vmartynets
Copy link
Contributor

@psteininger impersonated links works with v2 now (#62)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants