Add ID token verification endpoint #253
Conversation
|
We may also need By the way, there is no way to check/change LIFF app's scope 😕 |
lib/line/bot/client.rb
Outdated
| # @param options [Hash] Optional request body | ||
| # | ||
| # @return [Net::HTTPResponse] | ||
| def verify_id_token(id_token, options = {}) |
There was a problem hiding this comment.
Passing options as a hash may result in unintended parameters being passed to the endpoint. It may be too much to worry about, but it is better to be safe than sorry.
I think it would be better to pass only concrete parameters, i.e. nonce and user_id, like other methods such as narrowcast.
line-bot-sdk-ruby/lib/line/bot/client.rb
Line 257 in 8760add
| def verify_id_token(id_token, options = {}) | |
| def verify_id_token(id_token, nonce: nil, user_id: nil) |
|
|
||
| it 'verifies ID token' do | ||
| uri_template = Addressable::Template.new Line::Bot::API::DEFAULT_OAUTH_ENDPOINT + '/oauth2/v2.1/verify' | ||
| stub_request(:post, uri_template).to_return { |request| {body: '', status: 200} } |
There was a problem hiding this comment.
In the test, the body of the response is empty, but it actually returns the contents of the ID token. I think it would be better to add content validation for some values, referring to the "Example response" in the documentation.
https://developers.line.biz/en/reference/line-login/#verify-id-token-response
|
addressed @zenizh's reveiw and add implementation for verify_access_token and get_profile_by_access_token |
| # @param access_token [String] access token | ||
| # | ||
| # @return [Net::HTTPResponse] | ||
| def verify_access_token(access_token) |
There was a problem hiding this comment.
https://developers.line.biz/en/reference/line-login-v2/#verify-access-token
There is v2 version of this API.
Should I rename this to verify_access_token_v2_1?
I named this way since I thought v2.1 is superset of v2.
Same for get_profile_by_access_token.
There was a problem hiding this comment.
I think verify_access_token is fine. Because LINE Login v2.0 is deprecated. Also, the documentation comment says "Verify access token v2.1", so it seems that users will not have to worry about it.
|
@yskkin I'll be releasing a version next week that includes this change. Sorry for the wait! |
This is implementation for https://developers.line.biz/en/reference/line-login/#verify-id-token.
We need this for
liff.getIDToken().