Uh oh!
There was an error while loading. Please reload this page.
Add the ability to specify body hash method - #59
Conversation
drostron
commented
Aug 9, 2022
Looks like the failing tests are the same as on master. Is there interest in this or any feedback around it? Happy to update if there are desired changes. |
parsonsmatt
left a comment
There was a problem hiding this comment.
This looks good to me!
@snoyberg anything I can do to help get this merged and released?
| -- ^ Optional authorization realm (default: @Nothing@) | ||
| , oauthVersion :: OAuthVersion | ||
| -- ^ OAuth spec version (default: 'OAuth10a') | ||
| , oauthBodyHashMethod :: BodyHashMethod |
There was a problem hiding this comment.
Since the constructor isn't exposed, this is a feature addition - so a minor version bump
snoyberg
commented
Sep 1, 2022
I'm not really the maintainer of authenticate-oauth (though I've done some of the work on it recently), and I'm not sure if the maintainers are still following this repo. I'd be happy to add you both here and on Hackage if you'd like to jump in. |
Some APIs require the body hash method follow the signature hash method. While the spec alludes to the body hash method following the signature method, doing so would break library users expecting the current behavior of a SHA-1 body hash no matter what signature method is specified. An additional configuration parameter is added for the body hash method with a default of SHA-1 so users can update without changes and maintain current behavior.