-
-
Notifications
You must be signed in to change notification settings - Fork 361
Description
Describe the bug
I was attempting to configure Generic OAuth for my WriteFreely instance with my Mastodon instance. Initially, I followed what's described on https://writefreely.org/docs/latest/admin/config, and everything seemed to be working. I could link my Mastodon account on WriteFreely, and I could log into my WriteFreely account with my Mastodon account just fine... until I noticed that everybody that has an account on my Mastodon instance now authenticates as me on the WriteFreely instance.
A close inspection on the database revealed that the remote_user_id
field in the database was empty (null). This resulted in the single record being matched for every OAuth login request, thus resulting the aforementioned behavior.
After digging around in the source code, I realized that Mastodon does not return the user id in the field user_id
, but instead in id
, and WriteFreely needs a special configuration map_user_id
for that (and also a few other map_*
options). These are mentioned nowhere in the documentation.
So basically, the issue here is:
- The OAuth code should not appear as being working fine when in fact being horribly broken (i.e. when
remote_user_id
cannot be fetched). There should be some big red error / warning in the logs to notify the administrator of the situation, instead of having to dig around in the source code to find the solution. - The
map_*
options should be included somewhere noticeable in the documentation.
Steps to reproduce (if necessary)
- Set up OAuth authentication with Mastodon without providing
map_user_id
- Link any Mastodon account with any WriteFreely account
- Notice that now any Mastodon account registered on the linked instance can authenticate with said WriteFreely account
Expected behavior
- Step 2 in "Steps to reproduce" should have failed in the first place.
- Step 3 in "Steps to reproduce" should also fail (it should not match records with
remote_user_id
being null)
Version or last commit: 0.13.0