Skip to content

scaladoc about access_token query parameter #1192

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pjfanning wants to merge 1 commit into
base: main
Choose a base branch
from
+18 −0
Open

scaladoc about access_token query parameter #1192

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions .../src/main/scala/org/apache/pekko/http/scaladsl/server/directives/SecurityDirectives.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,12 @@ trait SecurityDirectives {
* The given authenticator determines whether the credentials in the request are valid
* and, if so, which user object to supply to the inner route.
*
* If no `Authorization: Bearer <token>` header is present, this directive falls back to
* extracting the token from the `access_token` query parameter. Per RFC 6750 Section 2.3,
* bearer tokens transmitted via query parameters may be leaked in server logs, browser history,
* HTTP Referer headers, and proxy logs. For browser-facing APIs, prefer requiring the
* `Authorization` header.
*
* @group security
*/
def authenticateOAuth2[T](realm: String, authenticator: Authenticator[T]): AuthenticationDirective[T] =
Expand All @@ -152,6 +158,12 @@ trait SecurityDirectives {
* The given authenticator determines whether the credentials in the request are valid
* and, if so, which user object to supply to the inner route.
*
* If no `Authorization: Bearer <token>` header is present, this directive falls back to
* extracting the token from the `access_token` query parameter. Per RFC 6750 Section 2.3,
* bearer tokens transmitted via query parameters may be leaked in server logs, browser history,
* HTTP Referer headers, and proxy logs. For browser-facing APIs, prefer requiring the
* `Authorization` header.
*
* @group security
*/
def authenticateOAuth2Async[T](realm: String, authenticator: AsyncAuthenticator[T]): AuthenticationDirective[T] =
Expand Down Expand Up @@ -180,6 +192,9 @@ trait SecurityDirectives {
* The given authenticator determines whether the credentials in the request are valid
* and, if so, which user object to supply to the inner route.
*
* Falls back to extracting the token from the `access_token` query parameter if no
* `Authorization` header is present. See [[authenticateOAuth2]] for security considerations.
*
* @group security
*/
def authenticateOAuth2PF[T](realm: String, authenticator: AuthenticatorPF[T]): AuthenticationDirective[T] =
Expand All @@ -190,6 +205,9 @@ trait SecurityDirectives {
* The given authenticator determines whether the credentials in the request are valid
* and, if so, which user object to supply to the inner route.
*
* Falls back to extracting the token from the `access_token` query parameter if no
* `Authorization` header is present. See [[authenticateOAuth2]] for security considerations.
*
* @group security
*/
def authenticateOAuth2PFAsync[T](realm: String, authenticator: AsyncAuthenticatorPF[T]): AuthenticationDirective[T] =
Expand Down