From e1abd36b016220fdea8756d8a9c730ad44259556 Mon Sep 17 00:00:00 2001
From: Jesse Wright <63333554+jeswr@users.noreply.github.com>
Date: Mon, 15 Jun 2026 11:46:05 +0100
Subject: [PATCH] fix: allow opting in to insecure OAuth requests

oauth4webapi enforces HTTPS on every request, so the auth-code + PKCE +
DPoP flow could not talk to a local Community Solid Server over plain
HTTP. Rather than guessing which issuers are loopback, expose a global
switch consumers toggle themselves.

InsecureConfiguration.allow() is deprecated on purpose so the security
implication shows up at the call site.

Also replaces the unconditional allow in BearerTokenProvider, and covers
ClientCredentialsTokenProvider, which had no way to reach a local
issuer at all.
---
 index.html                            |  5 ++++-
 src/BearerTokenProvider.ts            | 10 ++++-----
 src/ClientCredentialsTokenProvider.ts |  7 +++++--
 src/DPoPTokenProvider.ts              |  7 ++++---
 src/InsecureConfiguration.ts          | 29 +++++++++++++++++++++++++++
 src/mod.ts                            |  1 +
 6 files changed, 47 insertions(+), 12 deletions(-)
 create mode 100644 src/InsecureConfiguration.ts

diff --git a/index.html b/index.html
index c835634..972841a 100644
--- a/index.html
+++ b/index.html
@@ -15,9 +15,12 @@
             }
         </script>
         <script type="module">
-            import { DPoPTokenProvider, ReactiveFetchManager } from "./dist/mod.js"
+            import { DPoPTokenProvider, InsecureConfiguration, ReactiveFetchManager } from "./dist/mod.js"
             import "./dist/registerElements.js"
 
+            /* Demo talks to a local Community Solid Server over plain HTTP */
+            InsecureConfiguration.allow()
+
             /* Reactive fetch infrastructure */
             const ui = document.querySelector("authorization-code-flow")
             const issuerUi = document.querySelector("idp-picker")
diff --git a/src/BearerTokenProvider.ts b/src/BearerTokenProvider.ts
index 051af48..6e98225 100644
--- a/src/BearerTokenProvider.ts
+++ b/src/BearerTokenProvider.ts
@@ -1,9 +1,7 @@
 import * as oauth from "oauth4webapi"
 import { GetCodeCallback } from "./GetCodeCallback.js"
 import { TokenProvider } from "./TokenProvider.js"
-
-// TODO: Configure properly for insecure localhost only
-const oauthAllowInsecureRequests = true
+import { InsecureConfiguration } from "./InsecureConfiguration.js"
 
 export class BearerTokenProvider implements TokenProvider {
     readonly #getCode: GetCodeCallback
@@ -43,12 +41,12 @@ export class BearerTokenProvider implements TokenProvider {
     async upgrade(request: Request): Promise<Request> {
         const issuer = await this.#getIssuer(request)
 
-        const discoveryResponse = await oauth.discoveryRequest(issuer, {[oauth.allowInsecureRequests]: oauthAllowInsecureRequests})
+        const discoveryResponse = await oauth.discoveryRequest(issuer, InsecureConfiguration.requestOptions)
         const authorizationServer = await oauth.processDiscoveryResponse(issuer, discoveryResponse)
 
         const callbackUri = await this.#getCallback(request)
 
-        const registrationResponse = await oauth.dynamicClientRegistrationRequest(authorizationServer, {redirect_uris: [callbackUri]}, {[oauth.allowInsecureRequests]: oauthAllowInsecureRequests})
+        const registrationResponse = await oauth.dynamicClientRegistrationRequest(authorizationServer, {redirect_uris: [callbackUri]}, InsecureConfiguration.requestOptions)
         const clientRegistration = await oauth.processDynamicClientRegistrationResponse(registrationResponse)
         const [registeredRedirectUri] = clientRegistration.redirect_uris as string[]
         const [registeredResponseType] = clientRegistration.response_types as string[]
@@ -84,7 +82,7 @@ export class BearerTokenProvider implements TokenProvider {
             clientAuth = authenticationMethod(clientSecret)
         }
 
-        const tokenResponse = await oauth.authorizationCodeGrantRequest(authorizationServer, clientRegistration, clientAuth, authorizationCodeParams, callbackUri, codeVerifier, {[oauth.allowInsecureRequests]: oauthAllowInsecureRequests})
+        const tokenResponse = await oauth.authorizationCodeGrantRequest(authorizationServer, clientRegistration, clientAuth, authorizationCodeParams, callbackUri, codeVerifier, InsecureConfiguration.requestOptions)
 
         // jwt nonce missing in igrant
         // const tokenResult = await oauth.processAuthorizationCodeResponse(authorizationServer, clientRegistration, tokenResponse, {expectedNonce: nonce})
diff --git a/src/ClientCredentialsTokenProvider.ts b/src/ClientCredentialsTokenProvider.ts
index 2bc32b5..1b7644a 100644
--- a/src/ClientCredentialsTokenProvider.ts
+++ b/src/ClientCredentialsTokenProvider.ts
@@ -2,6 +2,7 @@ import * as oauth from "oauth4webapi"
 import { AuthorizationServer } from "oauth4webapi"
 import * as DPoP from "dpop"
 import type { TokenProvider } from "./TokenProvider.js"
+import { InsecureConfiguration } from "./InsecureConfiguration.js"
 
 export class ClientCredentialsTokenProvider implements TokenProvider {
     constructor(private clientId: string, private clientSecret: string) {
@@ -35,7 +36,8 @@ export class ClientCredentialsTokenProvider implements TokenProvider {
         const issuer = await this.#getIssuer(request)
 
         const discoveryResponse = await oauth.discoveryRequest(issuer, {
-            signal: request.signal
+            signal: request.signal,
+            ...InsecureConfiguration.requestOptions
         })
         const authorizationServer = await oauth.processDiscoveryResponse(issuer, discoveryResponse)
 
@@ -46,7 +48,8 @@ export class ClientCredentialsTokenProvider implements TokenProvider {
 
         const tokenResponse = await oauth.clientCredentialsGrantRequest(authorizationServer, clientRegistration, this.getClientAuth(authorizationServer, clientRegistration), {scope: "webid"}, {
             DPoP: dpop,
-            signal: request.signal
+            signal: request.signal,
+            ...InsecureConfiguration.requestOptions
         })
 
         const tokenResult = await oauth.processClientCredentialsResponse(authorizationServer, clientRegistration, tokenResponse)
diff --git a/src/DPoPTokenProvider.ts b/src/DPoPTokenProvider.ts
index 4760ae2..f5108d4 100644
--- a/src/DPoPTokenProvider.ts
+++ b/src/DPoPTokenProvider.ts
@@ -3,6 +3,7 @@ import * as DPoP from "dpop"
 import type { GetCodeCallback } from "./GetCodeCallback.js"
 import type { TokenProvider } from "./TokenProvider.js"
 import type { GetIssuerCallback } from "./GetIssuerCallback.js"
+import { InsecureConfiguration } from "./InsecureConfiguration.js"
 
 export class DPoPTokenProvider implements TokenProvider {
     readonly #getCode: GetCodeCallback
@@ -22,10 +23,10 @@ export class DPoPTokenProvider implements TokenProvider {
     async upgrade(request: Request): Promise<Request> {
         const issuer = await this.#getIssuer(request)
 
-        const discoveryResponse = await oauth.discoveryRequest(issuer, {signal: request.signal})
+        const discoveryResponse = await oauth.discoveryRequest(issuer, {signal: request.signal, ...InsecureConfiguration.requestOptions})
         const authorizationServer = await oauth.processDiscoveryResponse(issuer, discoveryResponse)
 
-        const registrationResponse = await oauth.dynamicClientRegistrationRequest(authorizationServer, {redirect_uris: [this.#callbackUri]}, {signal: request.signal})
+        const registrationResponse = await oauth.dynamicClientRegistrationRequest(authorizationServer, {redirect_uris: [this.#callbackUri]}, {signal: request.signal, ...InsecureConfiguration.requestOptions})
         const clientRegistration = await oauth.processDynamicClientRegistrationResponse(registrationResponse)
         const [registeredRedirectUri] = clientRegistration.redirect_uris as string[]
         const [registeredResponseType] = clientRegistration.response_types as string[]
@@ -79,7 +80,7 @@ export class DPoPTokenProvider implements TokenProvider {
             }
         }
 
-        const tokenResponse = await oauth.authorizationCodeGrantRequest(authorizationServer, clientRegistration, this.getClientAuth(authorizationServer.issuer, clientRegistration), authorizationCodeParams, this.#callbackUri, authorizationServer.code_challenge_methods_supported !== undefined ? codeVerifier : oauth.nopkce, {DPoP: dpop, signal: request.signal})
+        const tokenResponse = await oauth.authorizationCodeGrantRequest(authorizationServer, clientRegistration, this.getClientAuth(authorizationServer.issuer, clientRegistration), authorizationCodeParams, this.#callbackUri, authorizationServer.code_challenge_methods_supported !== undefined ? codeVerifier : oauth.nopkce, {DPoP: dpop, signal: request.signal, ...InsecureConfiguration.requestOptions})
 
         const tokenResult = await oauth.processAuthorizationCodeResponse(authorizationServer, clientRegistration, tokenResponse, {expectedNonce: this.nonceVerificationOverride(authorizationServer.issuer, nonce)})
 
diff --git a/src/InsecureConfiguration.ts b/src/InsecureConfiguration.ts
new file mode 100644
index 0000000..1d46b86
--- /dev/null
+++ b/src/InsecureConfiguration.ts
@@ -0,0 +1,29 @@
+import * as oauth from "oauth4webapi"
+
+/**
+ * Global opt-in switch for oauth4webapi's HTTPS enforcement.
+ *
+ * @remarks
+ * Enforcement is on by default. Consumers targeting a plain HTTP issuer, such as a
+ * Community Solid Server on `http://localhost:3000`, opt out for themselves.
+ */
+export class InsecureConfiguration {
+    static #allowed = false
+
+    /**
+     * Allows OAuth requests over plain HTTP.
+     *
+     * @remarks
+     * Deprecated on purpose, so that consumers see the security implication at the call site.
+     *
+     * @deprecated Only ever call this in local development.
+     */
+    static allow() {
+        console.error("Insecure requests allowed for oauth4webapi")
+        this.#allowed = true
+    }
+
+    static get requestOptions(): {[oauth.allowInsecureRequests]?: boolean} {
+        return {[oauth.allowInsecureRequests]: this.#allowed}
+    }
+}
diff --git a/src/mod.ts b/src/mod.ts
index 0342cf6..7ddf99f 100644
--- a/src/mod.ts
+++ b/src/mod.ts
@@ -14,3 +14,4 @@ export * from "./IdpPicker.js"
 export * from "./WebIdPicker.js"
 export * from "./WebIdRequestCancelledError.js"
 export * from "./IssuerRequestCancelledError.js"
+export * from "./InsecureConfiguration.js"