OAuth 2.0 Authorization Window does not respect "Validate certificates" setting
See original GitHub issueDescribe the bug When fetching a new “authorization code” token with help from the OAuth 2.0 auth helper, if the “Authorization URL” uses a self-signed certificate, the Authorization Window appears, but is blank. This is regardless of the “Validate certificates” setting in the preferences window.
To Reproduce Steps to reproduce the behavior:
- Set the “Validate Certificates” setting in the preferences window to “false” (unchecked):
- In an “OAuth 2.0” mode auth tab, enter valid settings including:
- The “grant type” field with a value of “Authorization Code”
- The “authorization URL” field pointing to an HTTPS URL which does not use a valid HTTPS certificate (such as
localhost
or127.0.0.1
)
- Click on ‘Fetch Tokens’
- Note the blank window appearing and no network traffic
- Note the error in the DevTools console, despite the “Validate certificates” setting from earlier:
Uncaught (in promise) Error: ERR_CERT_AUTHORITY_INVALID (-202) loading 'https://127.0.0.1:5001/connect/authorize?response_type=code&client_id=insomnia&redirect_uri=https%3A%2F%2Ffake.url%2Foidc-callback&scope=openid%20profile%20email%20otherscopes&state=820813df-8ca6-4fd3-83c5-45fd3f1a5f7a'
Expected behavior Assuming “Validate certificates” is set to false (unchecked), the Authorization Window should correctly send a request to the Authorization URL server and display the HTML response so the user can authenticate.
Desktop:
- OS: macOS 10.15.7 (this might be important as this could be a macOS specific issue)
- Installation Method: Manual Install (
.dmg
download from website) - App Version: Insomnia Core 2020.4.1
Issue Analytics
- State:
- Created 3 years ago
- Reactions:6
- Comments:9 (1 by maintainers)
Top Results From Across the Web
Certificates and JWTs (JSON Web Tokens) | Using OAuth 2.0 ...
Authorization server needs to verify signatures of JWTs sent by a client, Obtain a certificate owned by that client, as well as the...
Read more >Protect API's using OAuth 2.0 in APIM
To pre-Authorize requests, we can use <validate-jwt> Policy by validating the access tokens of each incoming request. If a request does not have ......
Read more >RFC 6749: The OAuth 2.0 Authorization Framework
When issuing an access token during the implicit grant flow, the authorization server does not authenticate the client. In some cases, the client...
Read more >OpenID Connect | Authentication - Google Developers
If there is no OAuth 2.0 client IDs section on the Credentials page, then your project has no OAuth credentials. To create one,...
Read more >Act as an OAuth 2.0 resource server - ForgeRock Backstage
An OAuth 2.0 access token is an opaque string issued by the authorization ... If there is no access token in the request,...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
This does actually appear to be working for me now. I had an issue with the certificate which, when fixed, seemed to make the login /validation work as expected.