diff options
| author | Juha Vuolle <juha.vuolle@qt.io> | 2024-11-29 12:50:13 +0200 |
|---|---|---|
| committer | Juha Vuolle <juha.vuolle@qt.io> | 2024-12-04 14:27:07 +0200 |
| commit | b1e67440a6c2fbccdecd599def6f9822a31d5b07 (patch) | |
| tree | 11ee156cd1150e0cf46f519256efb16131a4f3f9 /src/oauth/qoauthhttpserverreplyhandler_p.h | |
| parent | 201a224441c2dc83e54cbc606b04ea9006ada7f8 (diff) | |
Improve callback/redirect_uri hostname setting
Setting hostname part of redirect uri (callback) is important
part to get correct, because authorization servers often expect
a verbatim match between what has been registered, and what is
sent as part of authorization request. This commit clarifies and
improves specifying the hostname part.
Historically the callback host was fixed to "127.0.0.1" which has
its drawbacks (and can be outright wrong). The situation was
later improved by using "localhost" hostname, which correctly maps
to both IPv4 and IPv6 interfaces. However, there are authorization
servers which require the use of IP literals, and reject "localhost".
To address these issues, this commit consists of:
- Map Any, AnyIPv4, and AnyIPv6 to "localhost". This
mapping is logical because "localhost" will work then
independent of what the actual used address is
- Map IPv4 and IPv6 loopback addresses (LocalHost, LocalHostIPv6)
to their IP literals 127.0.0.1 and ::1
These are well-known IP literal addresses,
and mapping them to "localhost" does not bring an advantage
- If user has provided a string literal, use that directly
- Change default address to "LocalHost", which maps to hostname
"127.0.0.1". This, in part, undoes the changed behavior where
the default changed to "localhost". With this change,
users that don't define callback address shouldn't notice a
difference to the very original behavior
All in all these changes should improve the compatibility
with various authorization servers and provide more flexibility
to users.
Amends: fd49b7f6543e7b49be7847624c64ee86c4272ccd
Amends: 4e03167088181bf513adcfb8aac93fb8efb3f420
[ChangeLog][QOAuthHttpServerReplyHandler] Changed and clarified
callback hostname handling (especially localhost vs. 127.0.0.1)
Pick-to: 6.8
Fixes: QTBUG-130159
Change-Id: I25dfb996d10f95fe60bdb4f46ea848edcb2528be
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>
Diffstat (limited to 'src/oauth/qoauthhttpserverreplyhandler_p.h')
| -rw-r--r-- | src/oauth/qoauthhttpserverreplyhandler_p.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/oauth/qoauthhttpserverreplyhandler_p.h b/src/oauth/qoauthhttpserverreplyhandler_p.h index 57b8ff6..104ed68 100644 --- a/src/oauth/qoauthhttpserverreplyhandler_p.h +++ b/src/oauth/qoauthhttpserverreplyhandler_p.h @@ -36,6 +36,7 @@ public: ~QOAuthHttpServerReplyHandlerPrivate(); QString callback() const; + QString callbackHost() const; QTcpServer *httpServer = nullptr; QString text; |