From 4ea219b1f783370c39be3e776e664f71348c67c9 Mon Sep 17 00:00:00 2001 From: Elias Meire Date: Fri, 28 Mar 2025 19:59:30 +0100 Subject: [PATCH] fix(core): Fix OAuth1 callback token request (#14251) --- .../__tests__/oauth1-credential.controller.test.ts | 6 +----- .../controllers/oauth/oauth1-credential.controller.ts | 10 ++++++---- 2 files changed, 7 insertions(+), 9 deletions(-) diff --git a/packages/cli/src/controllers/oauth/__tests__/oauth1-credential.controller.test.ts b/packages/cli/src/controllers/oauth/__tests__/oauth1-credential.controller.test.ts index 515b9bad7a..d5207236b7 100644 --- a/packages/cli/src/controllers/oauth/__tests__/oauth1-credential.controller.test.ts +++ b/packages/cli/src/controllers/oauth/__tests__/oauth1-credential.controller.test.ts @@ -230,15 +230,11 @@ describe('OAuth1CredentialController', () => { }); jest.spyOn(Csrf.prototype, 'verify').mockReturnValueOnce(true); nock('https://example.domain') - .post('/oauth/access_token', { - oauth_token: 'token', - oauth_verifier: 'verifier', - }) + .post('/oauth/access_token', 'oauth_token=token&oauth_verifier=verifier') .once() .reply(200, 'access_token=new_token'); await controller.handleCallback(req, res); - const dataCaptor = captor(); expect(credentialsRepository.update).toHaveBeenCalledWith( '1', diff --git a/packages/cli/src/controllers/oauth/oauth1-credential.controller.ts b/packages/cli/src/controllers/oauth/oauth1-credential.controller.ts index 2c06e19fb3..7e6a096e04 100644 --- a/packages/cli/src/controllers/oauth/oauth1-credential.controller.ts +++ b/packages/cli/src/controllers/oauth/oauth1-credential.controller.ts @@ -118,10 +118,12 @@ export class OAuth1CredentialController extends AbstractOAuthController { const [credential, _, oauthCredentials] = await this.resolveCredential(req); - const oauthToken = await axios.post(oauthCredentials.accessTokenUrl, { - oauth_token, - oauth_verifier, - }); + // Form URL encoded body https://datatracker.ietf.org/doc/html/rfc5849#section-3.5.2 + const oauthToken = await axios.post( + oauthCredentials.accessTokenUrl, + { oauth_token, oauth_verifier }, + { headers: { 'content-type': 'application/x-www-form-urlencoded' } }, + ); // Response comes as x-www-form-urlencoded string so convert it to JSON