itchannel/fordpass-ha

v1.70 has a typo in the generate_url at line 216

Closed this issue · 1 comments

url = f"{REGIONS[region]["locale_url"]}/4566605f-43a7-400a-946e-89cc9fdb0bd7/B2C_1A_SignInSignUp_{REGIONS[region]["locale"]}/oauth2/v2.0/authorize?redirect_uri=fordapp://userauthorized&response_type=code&max_age=3600&code_challenge={code_verifier}&code_challenge_method=S256&scope=%2009852200-05fd-41f6-8c21-d36d3497dc64%20openid&client_id=09852200-05fd-41f6-8c21-d36d3497dc64&ui_locales={REGIONS[region]["locale"]}&language_code={REGIONS[region]["locale"]}&country_code={REGIONS[region]["locale_short"]}&ford_application_id={REGIONS[region]["region"]}"

within line 216 the complex URL that is built has an odd format that made me look at the HTTP decoded text.
scope=%2009852200-05fd-41f6-8c21-d36d3497dc64%20openid&

http decoded is:
scope= 09852200-05fd-41f6-8c21-d36d3497dc64 openid&

notice the spaces between the key and value? My best guess is this is a typo, as the scope value in fordpass_new.py at line 151 is:
scope=openid&

My mistake, spaces are part of the spec:
https://auth0.com/docs/get-started/apis/scopes/openid-connect-scopes
The basic (and required) scope for OIDC is openid, which indicates that an application intends to use the OIDC protocol to verify a user's identity. Beyond that, an application can ask for additional scopes by listing the requested scope names in the scope parameter, separated by spaces.