Amazon Pay C# SDK 3.9.1

amzn · Mar 23, 2021 · a4223dd · a4223dd
1 parent 9d54698
commit a4223dd
Show file tree

Hide file tree

Showing 7 changed files with 14 additions and 9 deletions.
diff --git a/AmazonPay.nuspec b/AmazonPay.nuspec
@@ -2,16 +2,16 @@
 <package >
   <metadata>
     <id>$id$</id>
-    <version>3.9.0</version>
+    <version>3.9.1</version>
     <title>$title$</title>
     <authors>AmazonPay</authors>
     <owners>AmazonPay</owners>
     <projectUrl>https://github.com/amzn/amazon-pay-sdk-csharp</projectUrl>
     <iconUrl>https://images-na.ssl-images-amazon.com/images/G/01/Iris3_US/en_US/inca/images/60x38-white-x1.png</iconUrl>
     <requireLicenseAcceptance>false</requireLicenseAcceptance>
     <description>AmazonPay service. This API section enables you to programmatically retrieve shipping and payment information provided by the buyer from their Amazon account. It allows you to authorize, capture, and refund payments, enabling a variety of payments scenarios.</description>
-    <releaseNotes>v3.8.0</releaseNotes>
-    <copyright>Copyright 2018-2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.</copyright>
+    <releaseNotes>v3.9.1</releaseNotes>
+    <copyright>Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.</copyright>
     <tags>AmazonPay</tags>
     <dependencies>
       <dependency id="Newtonsoft.Json" version="12.0.2" />

diff --git a/AmazonPay/AmazonPay.csproj b/AmazonPay/AmazonPay.csproj
@@ -4,7 +4,7 @@
     <TargetFrameworks>netstandard2.0;net20</TargetFrameworks>
     <Copyright>Copyright Amazon.com Inc. or its affiliates.</Copyright>
     <Company>Amazon Pay</Company>
-    <Version>3.9.0</Version>
+    <Version>3.9.1</Version>
     <SignAssembly>true</SignAssembly>
     <AssemblyOriginatorKeyFile>KeyFile.snk</AssemblyOriginatorKeyFile>
   </PropertyGroup>

diff --git a/AmazonPay/AmazonPay.nuspec b/AmazonPay/AmazonPay.nuspec
@@ -2,15 +2,15 @@
 <package >
   <metadata>
     <id>$id$</id>
-    <version>3.9.0</version>
+    <version>3.9.1</version>
     <title>$title$</title>
     <authors>AmazonPay</authors>
     <owners>AmazonPay</owners>
     <projectUrl>https://github.com/amzn/amazon-pay-sdk-csharp</projectUrl>
     <iconUrl>https://images-na.ssl-images-amazon.com/images/G/01/Iris3_US/en_US/inca/images/60x38-white-x1.png</iconUrl>
     <requireLicenseAcceptance>false</requireLicenseAcceptance>
     <description>AmazonPay service. This API section enables you to programmatically retrieve shipping and payment information provided by the buyer from their Amazon account. It allows you to authorize, capture, and refund payments, enabling a variety of payments scenarios.</description>
-    <releaseNotes>v3.9.0</releaseNotes>
+    <releaseNotes>v3.9.1</releaseNotes>
     <copyright>Copyright Amazon.com Inc. or its affiliates.</copyright>
     <tags>AmazonPay</tags>
     <dependencies>

diff --git a/AmazonPay/Client.cs b/AmazonPay/Client.cs
@@ -398,9 +398,11 @@ public string GetUserInfo(string accessToken)
             }
 
             accessToken = System.Web.HttpUtility.UrlDecode(accessToken);
-            string url = profileEndpoint + "/auth/o2/tokeninfo?access_token=" + System.Web.HttpUtility.UrlEncode(accessToken);
+            string url = profileEndpoint + "/auth/o2/tokeninfo";
 
             HttpImpl httpRequest = new HttpImpl(clientConfig);
+            httpRequest.setAccessToken(accessToken);
+            httpRequest.setHttpHeader();
             response = httpRequest.Get(url);
 
             Dictionary<string, string> data = JsonConvert.DeserializeObject<Dictionary<string, string>>(response);

diff --git a/AmazonPay/Constants.cs b/AmazonPay/Constants.cs
@@ -7,7 +7,7 @@ namespace AmazonPay
 {
     public static class Constants
     {
-        public static readonly string SDKClientVersion = "3.9.0";
+        public static readonly string SDKClientVersion = "3.9.1";
         public static readonly string SDKName = "amazon-pay-sdk-csharp";
         public static readonly string PaymentsServiceVersion = "2013-01-01";
         public static readonly int MaxErrorRetry = 3;

diff --git a/AmazonPay/HttpImpl.cs b/AmazonPay/HttpImpl.cs
@@ -72,7 +72,7 @@ private HttpWebRequest ConfigureWebRequest(string method, string url, string use
             }
             if (header)
             {
-                request.Headers.Add("Authorization: bearer " + accessToken);
+                request.Headers.Add("x-amz-access-token:" + accessToken);
             }
             request.Method = method;
             request.ContentType = "application/x-www-form-urlencoded; charset=utf-8";

diff --git a/CHANGES.txt b/CHANGES.txt
@@ -1,3 +1,6 @@
+Version 3.9.1 - March 2021
+- Fixed security risk - Buyer Access token is passed as HTTP header instead of query parameter in URL for GetUserInfo API
+
 Version 3.9.0 - February 2021
 - Added additional attribute (expectImmediateAuthorization) to ConfirmOrderReference. This value can be set to true or false (Boolean). See Amazon Pay Strong Customer Authentication (SCA) Upgrade Integration Guide for more information.