TheSunIsLeaking/DorkNet
3
0
Fork 0
mirror of https://github.com/DorkSquadRR/DorkNet.git synced 2026-10-25 23:18:44 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #74 from DorkSquadRR/fix/signin-userinfo

Browse Source 
fix(auth): don't read the provider's userinfo endpoint by default
This commit is contained in:
Alexa
2026-10-25 17:27:40 +02:00
committed by GitHub
parent 99f8c2e016 94781fd11a
commit 5b7cded2a9
3 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DorkNet.Server/Services/ExternalSignIn.cs
+6
View File
@@ -26,6 +26,12 @@ public sealed class ExternalSignInOptions
public string Scopes { get; set; } = "openid email profile"; public string Scopes { get; set; } = "openid email profile";
/// <summary>Also read the provider's userinfo endpoint after sign-in. Off by
/// default: the ID token already carries <c>sub</c> and <c>email</c>, and
/// Cloudflare Access answers userinfo without a Content-Type, which the
/// OpenID Connect handler rejects.</summary>
public bool UseUserInfoEndpoint { get; set; }
public bool IsConfigured => public bool IsConfigured =>
Authority.Length > 0 && ClientId.Length > 0 && ClientSecret.Length > 0; Authority.Length > 0 && ClientId.Length > 0 && ClientSecret.Length > 0;
} }
DorkNet.Server/Startup/ServiceCollectionExtensions.cs
+1 -1
View File
@@ -484,7 +484,7 @@ public static class ServiceCollectionExtensions
o.Scope.Add(scope); o.Scope.Add(scope);
o.SignInScheme = ExternalSignIn.ExternalScheme; o.SignInScheme = ExternalSignIn.ExternalScheme;
o.CallbackPath = ExternalSignIn.CallbackPath; o.CallbackPath = ExternalSignIn.CallbackPath;
o.GetClaimsFromUserInfoEndpoint = true; o.GetClaimsFromUserInfoEndpoint = signIn.UseUserInfoEndpoint;
o.MapInboundClaims = false; o.MapInboundClaims = false;
o.SaveTokens = false; o.SaveTokens = false;
o.CorrelationCookie.SecurePolicy = secure; o.CorrelationCookie.SecurePolicy = secure;
docs/deploy.md
+3
View File
@@ -477,6 +477,9 @@ DorkNet__SignIn__ClientSecret=<client secret>
DorkNet__SignIn__DisplayName=Cloudflare DorkNet__SignIn__DisplayName=Cloudflare
# Optional: scopes, default "openid email profile". # Optional: scopes, default "openid email profile".
DorkNet__SignIn__Scopes=openid email profile DorkNet__SignIn__Scopes=openid email profile
# Optional: also read the userinfo endpoint (default false; the ID token is
# enough for most providers, and Cloudflare Access's userinfo can't be read).
DorkNet__SignIn__UseUserInfoEndpoint=false
``` ```
Register these redirect URIs at the provider, one per host people sign in on: Register these redirect URIs at the provider, one per host people sign in on: