From 97d5c05a3c29a2215d9f472e9cff885e2c8521f0 Mon Sep 17 00:00:00 2001 From: Jeonghun Mun <109071398+jeonghun917@users.noreply.github.com> Date: Sun, 8 Nov 2026 08:46:34 +0000 Subject: [PATCH] Compare the DCR initial access token as bytes so a non-ASCII token gets a 401, not a 500 hmac.compare_digest raises TypeError when two str values hold non-ASCII characters, and the bearer value comes from the request. --- app/apps/common/oauth_views.py | 2 +- app/apps/common/tests/test_oauth.py | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/app/apps/common/oauth_views.py b/app/apps/common/oauth_views.py index 54733580..a73b3b84 100644 --- a/app/apps/common/oauth_views.py +++ b/app/apps/common/oauth_views.py @@ -88,7 +88,7 @@ def _dcr_initial_access_token_ok(request): scheme, _, value = header.partition(" ") if scheme.lower() != "bearer" or not value: return False - return hmac.compare_digest(value, expected) + return hmac.compare_digest(value.encode(), expected.encode()) @require_http_methods(["GET"]) diff --git a/app/apps/common/tests/test_oauth.py b/app/apps/common/tests/test_oauth.py index b096ada9..7453c923 100644 --- a/app/apps/common/tests/test_oauth.py +++ b/app/apps/common/tests/test_oauth.py @@ -224,6 +224,18 @@ class DynamicClientRegistrationInitialAccessTokenTests(TestCase): self.assertEqual(response.json()["error"], "invalid_token") self.assertEqual(Application.objects.count(), 0) + def test_rejects_registration_with_non_ascii_initial_access_token(self): + response = self.client.post( + reverse("oauth-dynamic-client-registration"), + data=json.dumps({"redirect_uris": ["http://127.0.0.1:8765/callback"]}), + content_type="application/json", + HTTP_AUTHORIZATION="Bearer s3cret-iat\u00e9", + ) + + self.assertEqual(response.status_code, 401) + self.assertEqual(response.json()["error"], "invalid_token") + self.assertEqual(Application.objects.count(), 0) + def test_allows_registration_with_initial_access_token(self): response = self.client.post( reverse("oauth-dynamic-client-registration"),