AuthorizationServer::isSecure() - Code Metrics - Inspection of "Merge remote-tracking branch 'origin/master'" - php-guard/oauth-server - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( 8278f2...2a258c )

by Alexandre

created 2018-06-02 18:18 UTC

AuthorizationServer::isSecure() A

↳ Parent: AuthorizationServer

Complexity

Conditions	3
Paths	3

Size

Total Lines	3
Code Lines	1

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	3
eloc	1
nc	3
nop	0
dl	0
loc	3
rs	10
c	0
b	0
f	0

<?php
/**
 * Created by PhpStorm.
 * User: Alexandre
 * Date: 10/03/2018
 * Time: 15:55
 */

namespace OAuth2\Roles;


use OAuth2\ClientAuthentication\ClientAuthenticationMethodManager;
use OAuth2\ClientAuthentication\ClientSecretBasicAuthenticationMethod;
use OAuth2\ClientAuthentication\ClientSecretPostAuthenticationMethod;
use OAuth2\Config;
use OAuth2\Endpoints\AuthorizationEndpoint;
use OAuth2\Endpoints\AuthorizationRequestBuilder;
use OAuth2\Endpoints\EndpointInterface;
use OAuth2\Endpoints\TokenEndpoint;
use OAuth2\AuthorizationGrantTypes\Flows\AuthorizationCodeFlow;
use OAuth2\AuthorizationGrantTypes\Flows\ClientCredentialsFlow;
use OAuth2\AuthorizationGrantTypes\Flows\FlowManager;
use OAuth2\AuthorizationGrantTypes\Flows\ImplicitFlow;
use OAuth2\AuthorizationGrantTypes\Flows\ResourceOwnerPasswordCredentialsFlow;
use OAuth2\AuthorizationGrantTypes\GrantTypeManager;
use OAuth2\AuthorizationGrantTypes\RefreshTokenGrantType;
use OAuth2\ResponseModes\FragmentResponseMode;
use OAuth2\ResponseModes\QueryResponseMode;
use OAuth2\ResponseModes\ResponseModeManager;
use OAuth2\AuthorizationEndpointResponseTypes\ResponseTypeManager;
use OAuth2\ScopePolicy\ScopePolicyManager;
use OAuth2\Storages\StorageManager;


class AuthorizationServer implements AuthorizationServerInterface
{
    protected $authorizationEndpoint;
    protected $tokenEndpoint;
    protected $responseTypeManager;
    protected $scopePolicyManager;
    protected $grantTypeManager;
    protected $clientAuthenticationMethodManager;
    protected $responseModeManager;
    protected $flowManager;

    public function __construct(Config $config,
                                StorageManager $storageManager,
                                AuthorizationServerEndUserInterface $authorizationServerEndUser)
    {
        $this->responseTypeManager = new ResponseTypeManager();
        $this->scopePolicyManager = new ScopePolicyManager($config);
        $this->grantTypeManager = new GrantTypeManager();

        $this->clientAuthenticationMethodManager = new ClientAuthenticationMethodManager($storageManager->getClientStorage());
        $this->clientAuthenticationMethodManager->addClientAuthenticationMethod('client_secret_basic',
            new ClientSecretBasicAuthenticationMethod($storageManager->getClientStorage()));
        $this->clientAuthenticationMethodManager->addClientAuthenticationMethod('client_secret_post',
            new ClientSecretPostAuthenticationMethod($storageManager->getClientStorage()));

//        $queryResponseMode = new QueryResponseMode();

        $this->responseModeManager = new ResponseModeManager();
        $this->responseModeManager->addResponseMode('query', new QueryResponseMode());
        $this->responseModeManager->addResponseMode('fragment', new FragmentResponseMode());

        // response_type : code
        // grant_type : authorization_code
        $authorizationCodeFlow = new AuthorizationCodeFlow(
            $config,
            $storageManager->getAuthorizationCodeStorage(),
            $storageManager->getAccessTokenStorage(),
            $storageManager->getRefreshTokenStorage()
        );

        // response_type : token
        $implicitFlow = new ImplicitFlow(
            $storageManager->getAccessTokenStorage(),
            $storageManager->getRefreshTokenStorage()
        );

        // grant_type : password
        $resourceOwnerPasswordCredentialsFlow = new ResourceOwnerPasswordCredentialsFlow(
            $this->scopePolicyManager,
            $storageManager->getResourceOwnerStorage(),
            $storageManager->getAccessTokenStorage(),
            $storageManager->getRefreshTokenStorage());

        // grant_type : client_credentials
        $clientCredentialsFlow = new ClientCredentialsFlow(
            $this->scopePolicyManager,
            $storageManager->getAccessTokenStorage(),
            $storageManager->getRefreshTokenStorage()
        );

        // grant_type : refresh_token
        $refreshTokenGrantType = new RefreshTokenGrantType(
            $storageManager->getAccessTokenStorage(),
            $storageManager->getRefreshTokenStorage(),
            $config,
            $this->scopePolicyManager
        );

        $this->flowManager = new FlowManager($this->responseTypeManager, $this->grantTypeManager);
        $this->flowManager->addFlow($authorizationCodeFlow);
        $this->flowManager->addFlow($implicitFlow);
        $this->flowManager->addFlow($resourceOwnerPasswordCredentialsFlow);
        $this->flowManager->addFlow($clientCredentialsFlow);

        $this->grantTypeManager->addGrantType('refresh_token', $refreshTokenGrantType);

        $authorizationRequestBuilder = new AuthorizationRequestBuilder(
            $storageManager->getClientStorage(),
            $this->responseTypeManager,
            $this->responseModeManager,
            $this->scopePolicyManager
        );
        $this->authorizationEndpoint = new AuthorizationEndpoint($authorizationRequestBuilder, $authorizationServerEndUser);

        $this->tokenEndpoint = new TokenEndpoint(
            $storageManager->getClientStorage(),
            $this->grantTypeManager,
            $this->clientAuthenticationMethodManager);
    }

    /**
     * @return AuthorizationEndpoint
     */
    public function getAuthorizationEndpoint(): EndpointInterface
    {
        return $this->authorizationEndpoint;
    }

    /**
     * @return TokenEndpoint
     */
    public function getTokenEndpoint(): EndpointInterface
    {
        return $this->tokenEndpoint;
    }

    /**
     * @return bool
     *
     * @see https://tools.ietf.org/html/rfc6749#section-3.1.2.1
     *
     *  Endpoint Request Confidentiality
     *
     *     The redirection endpoint SHOULD require the use of TLS as described
     * in Section 1.6 when the requested response type is "code" or "token",
     * or when the redirection request will result in the transmission of
     * sensitive credentials over an open network.  This specification does
     * not mandate the use of TLS because at the time of this writing,
     * requiring clients to deploy TLS is a significant hurdle for many
     * client developers.  If TLS is not available, the authorization server
     * SHOULD warn the resource owner about the insecure endpoint prior to
     * redirection (e.g., display a message during the authorization
     * request).
     *
     * Lack of transport-layer security can have a severe impact on the
     * security of the client and the protected resources it is authorized
     * to access.  The use of transport-layer security is particularly
     * critical when the authorization process is used as a form of
     * delegated end-user authentication by the client (e.g., third-party
     * sign-in service).
     * @deprecated
     */
    public function isSecure()
    {
        return (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || $_SERVER['SERVER_PORT'] == 443;
    }
}

1			<?php
2			/**
3			* Created by PhpStorm.
4			* User: Alexandre
5			* Date: 10/03/2018
6			* Time: 15:55
7			*/
8
9			namespace OAuth2\Roles;
10
11
12			use OAuth2\ClientAuthentication\ClientAuthenticationMethodManager;
13			use OAuth2\ClientAuthentication\ClientSecretBasicAuthenticationMethod;
14			use OAuth2\ClientAuthentication\ClientSecretPostAuthenticationMethod;
15			use OAuth2\Config;
16			use OAuth2\Endpoints\AuthorizationEndpoint;
17			use OAuth2\Endpoints\AuthorizationRequestBuilder;
18			use OAuth2\Endpoints\EndpointInterface;
19			use OAuth2\Endpoints\TokenEndpoint;
20			use OAuth2\AuthorizationGrantTypes\Flows\AuthorizationCodeFlow;
21			use OAuth2\AuthorizationGrantTypes\Flows\ClientCredentialsFlow;
22			use OAuth2\AuthorizationGrantTypes\Flows\FlowManager;
23			use OAuth2\AuthorizationGrantTypes\Flows\ImplicitFlow;
24			use OAuth2\AuthorizationGrantTypes\Flows\ResourceOwnerPasswordCredentialsFlow;
25			use OAuth2\AuthorizationGrantTypes\GrantTypeManager;
26			use OAuth2\AuthorizationGrantTypes\RefreshTokenGrantType;
27			use OAuth2\ResponseModes\FragmentResponseMode;
28			use OAuth2\ResponseModes\QueryResponseMode;
29			use OAuth2\ResponseModes\ResponseModeManager;
30			use OAuth2\AuthorizationEndpointResponseTypes\ResponseTypeManager;
31			use OAuth2\ScopePolicy\ScopePolicyManager;
32			use OAuth2\Storages\StorageManager;
33
34
35			class AuthorizationServer implements AuthorizationServerInterface
36			{
37			protected $authorizationEndpoint;
38			protected $tokenEndpoint;
39			protected $responseTypeManager;
40			protected $scopePolicyManager;
41			protected $grantTypeManager;
42			protected $clientAuthenticationMethodManager;
43			protected $responseModeManager;
44			protected $flowManager;
45
46			public function __construct(Config $config,
47			StorageManager $storageManager,
48			AuthorizationServerEndUserInterface $authorizationServerEndUser)
49			{
50			$this->responseTypeManager = new ResponseTypeManager();
51			$this->scopePolicyManager = new ScopePolicyManager($config);
52			$this->grantTypeManager = new GrantTypeManager();
53
54			$this->clientAuthenticationMethodManager = new ClientAuthenticationMethodManager($storageManager->getClientStorage());
55			$this->clientAuthenticationMethodManager->addClientAuthenticationMethod('client_secret_basic',
56			new ClientSecretBasicAuthenticationMethod($storageManager->getClientStorage()));
57			$this->clientAuthenticationMethodManager->addClientAuthenticationMethod('client_secret_post',
58			new ClientSecretPostAuthenticationMethod($storageManager->getClientStorage()));
59
60			// $queryResponseMode = new QueryResponseMode();
			0 ignored issues – show Unused Code Comprehensibility introduced 2018-05-25 20:21 UTC by Report Bug Copy Issue Report `46%` of this comment could be valid code. Did you maybe forget this after debugging? Sometimes obsolete code just ends up commented out instead of removed. In this case it is better to remove the code once you have checked you do not need it. The code might also have been commented out for debugging purposes. In this case it is vital that someone uncomments it again or your project may behave in very unexpected ways in production. This check looks for comments that seem to be mostly valid code and reports them. Loading history...
61			$this->responseModeManager = new ResponseModeManager();
62			$this->responseModeManager->addResponseMode('query', new QueryResponseMode());
63			$this->responseModeManager->addResponseMode('fragment', new FragmentResponseMode());
64
65			// response_type : code
66			// grant_type : authorization_code
67			$authorizationCodeFlow = new AuthorizationCodeFlow(
68			$config,
69			$storageManager->getAuthorizationCodeStorage(),
70			$storageManager->getAccessTokenStorage(),
71			$storageManager->getRefreshTokenStorage()
72			);
73
74			// response_type : token
75			$implicitFlow = new ImplicitFlow(
76			$storageManager->getAccessTokenStorage(),
77			$storageManager->getRefreshTokenStorage()
78			);
79
80			// grant_type : password
81			$resourceOwnerPasswordCredentialsFlow = new ResourceOwnerPasswordCredentialsFlow(
82			$this->scopePolicyManager,
83			$storageManager->getResourceOwnerStorage(),
84			$storageManager->getAccessTokenStorage(),
85			$storageManager->getRefreshTokenStorage());
86
87			// grant_type : client_credentials
88			$clientCredentialsFlow = new ClientCredentialsFlow(
89			$this->scopePolicyManager,
90			$storageManager->getAccessTokenStorage(),
91			$storageManager->getRefreshTokenStorage()
92			);
93
94			// grant_type : refresh_token
95			$refreshTokenGrantType = new RefreshTokenGrantType(
96			$storageManager->getAccessTokenStorage(),
97			$storageManager->getRefreshTokenStorage(),
98			$config,
99			$this->scopePolicyManager
100			);
101
102			$this->flowManager = new FlowManager($this->responseTypeManager, $this->grantTypeManager);
103			$this->flowManager->addFlow($authorizationCodeFlow);
104			$this->flowManager->addFlow($implicitFlow);
105			$this->flowManager->addFlow($resourceOwnerPasswordCredentialsFlow);
106			$this->flowManager->addFlow($clientCredentialsFlow);
107
108			$this->grantTypeManager->addGrantType('refresh_token', $refreshTokenGrantType);
109
110			$authorizationRequestBuilder = new AuthorizationRequestBuilder(
111			$storageManager->getClientStorage(),
112			$this->responseTypeManager,
113			$this->responseModeManager,
114			$this->scopePolicyManager
115			);
116			$this->authorizationEndpoint = new AuthorizationEndpoint($authorizationRequestBuilder, $authorizationServerEndUser);
117
118			$this->tokenEndpoint = new TokenEndpoint(
119			$storageManager->getClientStorage(),
120			$this->grantTypeManager,
121			$this->clientAuthenticationMethodManager);
122			}
123
124			/**
125			* @return AuthorizationEndpoint
126			*/
127			public function getAuthorizationEndpoint(): EndpointInterface
128			{
129			return $this->authorizationEndpoint;
130			}
131
132			/**
133			* @return TokenEndpoint
134			*/
135			public function getTokenEndpoint(): EndpointInterface
136			{
137			return $this->tokenEndpoint;
138			}
139
140			/**
141			* @return bool
142			*
143			* @see https://tools.ietf.org/html/rfc6749#section-3.1.2.1
144			*
145			* Endpoint Request Confidentiality
146			*
147			* The redirection endpoint SHOULD require the use of TLS as described
148			* in Section 1.6 when the requested response type is "code" or "token",
149			* or when the redirection request will result in the transmission of
150			* sensitive credentials over an open network. This specification does
151			* not mandate the use of TLS because at the time of this writing,
152			* requiring clients to deploy TLS is a significant hurdle for many
153			* client developers. If TLS is not available, the authorization server
154			* SHOULD warn the resource owner about the insecure endpoint prior to
155			* redirection (e.g., display a message during the authorization
156			* request).
157			*
158			* Lack of transport-layer security can have a severe impact on the
159			* security of the client and the protected resources it is authorized
160			* to access. The use of transport-layer security is particularly
161			* critical when the authorization process is used as a form of
162			* delegated end-user authentication by the client (e.g., third-party
163			* sign-in service).
164			* @deprecated
165			*/
166			public function isSecure()
167			{
168			return (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') \|\| $_SERVER['SERVER_PORT'] == 443;
169			}
170			}

php-guard / oauth-server

Push — master ( 8278f2...2a258c )

AuthorizationServer::isSecure() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like