OpenID::OAuth::Response.from_success_response when NS_URI is missing

[mikeantonelli]

When an OpenID::Consumer::SuccessResponse does not include OpenID::OAuth::NS_URI, a call to OpenID::OAuth::Response.from_success_response returns an OpenID::OAuth::Response instance with default values for ns_alias and ns_uri and nil values for request_token and scope.

In order to defend against this, I have coded a check:

def oauth_response(openid_response)
  unless openid_response.message.namespaces.get_alias(OpenID::OAuth::NS_URI).blank?
    OpenID::OAuth::Response.from_success_response openid_response
  end
end

Should OpenID::OAuth::Response.from_success_response return nil or raise an error instead of returning an empty object when the NS_URI isn't present in the OpenID::Consumer::SuccessResponse?

[poloka]

+1

[tobiashm]

That's a good question. I'm not an expert on OAuth, so if anyone wants to chime in on this: Is the response invalid if the ns_uri is missing? Or is there a valid scenario for this?

[timcappalli]

This repo is being archived. Closing issue.