Commit 7e362984 authored by Andrei Mihu's avatar Andrei Mihu
Browse files

Allow subdomain variance in Facebook Limited Login token issuer field.

parent a1f82e28

CHANGELOG.md

+1 −0
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ The format is based on [keep a changelog](http://keepachangelog.com) and this pr 
## [Unreleased]

### Changed

- Stricter validation of limit in runtime storage list operations.

- Allow subdomain variance in Facebook Limited Login token issuer field.



### Fixed

- Fix response selection in purchase lookups by identifier.

social/social.go

+6 −1
Original line number Diff line number Diff line
@@ -782,7 +782,12 @@ func (c *Client) CheckFacebookLimitedLoginToken(ctx context.Context, appId strin 
		claims := token.Claims.(jwt.MapClaims)



		// Verify the issuer.

		if !claims.VerifyIssuer("https://facebook.com", true) {

		switch iss, _ := claims["iss"].(string); iss {

		case "https://www.facebook.com":

			fallthrough

		case "https://facebook.com":

			break

		default:

			return nil, fmt.Errorf("unexpected issuer: %v", claims["iss"])

		}