-
Notifications
You must be signed in to change notification settings - Fork 12
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bad Request when sending authenticated request with mashlib recipe #1
Comments
Thanks @angelo-v. This behavior is by design. Mashlib is using an older version of the OIDC interaction flow, which we no longer consider secure. We have investigated this (CommunitySolidServer/CommunitySolidServer#850, CommunitySolidServer/CommunitySolidServer#851) and determined that the issue lies with Mashlib. Changing behavior on the CSS side would be undesired for security reasons. There is a plan in the work for fixing Mashlib; once this is complete, the Mashlib recipe will also work for private resources. Currently, you can only access public resources. |
Thanks Ruben, I see and totally understand that. To clarify those things I propose to add a hint about that in the readme, so that it is clear to everybody trying the recipe |
I have tested with the new mashlib that uses the new auth both as a frontend and from a remote browse.html. In both cases, as long as my config has util/identifiers/suffix.json I CAN login and read private resources. When I change the setting to util/identifiers/subdomain.json (and recreate my data folder and recreate new accounts), I get the 400 error when I login and then attempt to read one of the resources (e.g. the README). The server message is this :
Again, I can use mashlib fine when using suffix style but get this error when using subdomain style. |
@joachimvh, should we turn this into a CSS issue? But perhaps it's worth upgrading the recipes first to the upcoming v2 and see if the issue still persists. |
I don't think this is something that we can (should?) solve. |
According to what standard? If this is true, then please put something in the README that warns people it won't work. |
I had a look and could indeed not find this so I might be wrong there. In that case it's a question of how the DPoP library these URLs. AFAIK the spec always requires HTTPS, but an exception was made in the library for |
Chiming in here to say that the Rather, we might want to check that the IP address resolved from the host is |
Hi, when starting the default mashlib recipe it works fine and looks very promising, nice work so far, thanks a lot.
I am facing an issue when I change the root
.acl
from public access, to only give access to my WebID:I can log in via mashlib, but I am getting
400
responses for any resource then.The server log says:
I checked the request that gets a
400
response and it contains anauthorization: Bearer ...
header.The WebID I am using is hosted on NSS 5.6.7.
I wonder if there is an incompatibility between the NSS auth and the CSS auth or the auth library that mashlib uses (solid-auth-client).
Anything I can do here?
The text was updated successfully, but these errors were encountered: