question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

OAuth 2.0 Authorization Window does not respect "Validate certificates" setting

See original GitHub issue

Describe the bug When fetching a new “authorization code” token with help from the OAuth 2.0 auth helper, if the “Authorization URL” uses a self-signed certificate, the Authorization Window appears, but is blank. This is regardless of the “Validate certificates” setting in the preferences window.

To Reproduce Steps to reproduce the behavior:

  1. Set the “Validate Certificates” setting in the preferences window to “false” (unchecked):
  2. In an “OAuth 2.0” mode auth tab, enter valid settings including:
  • The “grant type” field with a value of “Authorization Code”
  • The “authorization URL” field pointing to an HTTPS URL which does not use a valid HTTPS certificate (such as localhost or 127.0.0.1)
  1. Click on ‘Fetch Tokens’
  2. Note the blank window appearing and no network traffic
  3. Note the error in the DevTools console, despite the “Validate certificates” setting from earlier:
Uncaught (in promise) Error: ERR_CERT_AUTHORITY_INVALID (-202) loading 'https://127.0.0.1:5001/connect/authorize?response_type=code&client_id=insomnia&redirect_uri=https%3A%2F%2Ffake.url%2Foidc-callback&scope=openid%20profile%20email%20otherscopes&state=820813df-8ca6-4fd3-83c5-45fd3f1a5f7a'

Expected behavior Assuming “Validate certificates” is set to false (unchecked), the Authorization Window should correctly send a request to the Authorization URL server and display the HTML response so the user can authenticate.

Desktop:

  • OS: macOS 10.15.7 (this might be important as this could be a macOS specific issue)
  • Installation Method: Manual Install (.dmg download from website)
  • App Version: Insomnia Core 2020.4.1

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Reactions:6
  • Comments:9 (1 by maintainers)

github_iconTop GitHub Comments

5reactions
stale[bot]commented, May 27, 2021

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

3reactions
nathanjwtxcommented, Aug 27, 2021

This does actually appear to be working for me now. I had an issue with the certificate which, when fixed, seemed to make the login /validation work as expected.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Certificates and JWTs (JSON Web Tokens) | Using OAuth 2.0 ...
Authorization server needs to verify signatures of JWTs sent by a client, Obtain a certificate owned by that client, as well as the...
Read more >
Protect API's using OAuth 2.0 in APIM
To pre-Authorize requests, we can use <validate-jwt> Policy by validating the access tokens of each incoming request. If a request does not have ......
Read more >
RFC 6749: The OAuth 2.0 Authorization Framework
When issuing an access token during the implicit grant flow, the authorization server does not authenticate the client. In some cases, the client...
Read more >
OpenID Connect | Authentication - Google Developers
If there is no OAuth 2.0 client IDs section on the Credentials page, then your project has no OAuth credentials. To create one,...
Read more >
Act as an OAuth 2.0 resource server - ForgeRock Backstage
An OAuth 2.0 access token is an opaque string issued by the authorization ... If there is no access token in the request,...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found