Under some conditions the Salesforce app's OAuth consumer secret can be alphanumeric, but the form validator checks to make sure the provided value is_numeric().

Patch forthcoming.

CommentFileSizeAuthor
#7 Update_Form_Authorization_Validation_to_Accept_64_Alphanumeric_characters.patch981 bytesarmyguyinfl
#6 Update_Form_Authorization_Validation_to_Accept_64_Alphanumeric_characters.patch1 KBarmyguyinfl
#2 alpha-numeric-secret-3024372-2-D8.patch565 bytesacrosman

Comments

acrosman created an issue. See original summary.

acrosman’s picture

acrosman
Primary language English
Location South Carolina, US
commented
Assigned: acrosman » Unassigned
StatusFileSize
new alpha-numeric-secret-3024372-2-D8.patch565 bytes

Patch removing is_numeric just checks existence.

acrosman’s picture

acrosman
Primary language English
Location South Carolina, US
commented
Status: Active » Needs review

  • aaronbauman committed 9321d72 on 8.x-3.x authored by acrosman 
    Issue #3024372 by acrosman: Managed Apps can generate alphanumeric...
aaronbauman’s picture

aaronbauman
he/him
commented
Status: Needs review » Fixed

Thanks for the patch!

armyguyinfl’s picture

armyguyinfl commented
Issue tags: +Salesforce, +authorization
StatusFileSize
new Update_Form_Authorization_Validation_to_Accept_64_Alphanumeric_characters.patch1 KB

I came across the same issue today on the newer instances of Salesforce.
The input would now only allow numeric values but now with the provided patch the values could still be invalid inputs.
I think the following patch is a better solution to allow legacy consumer secret keys and the new generated consumer keys by Salesforce

armyguyinfl’s picture

armyguyinfl commented
StatusFileSize
new Update_Form_Authorization_Validation_to_Accept_64_Alphanumeric_characters.patch981 bytes
aaronbauman’s picture

aaronbauman
he/him
commented

I can't find anything from Salesforce that spells out what a valid consumer key looks like, so it doesn't seem worth trying to guess at all the possibilities.

If you can find some docs from Salesforce that spec out the validation criteria, then we can implement some more robust validation.
Otherwise I think it's best to just make sure it's not empty.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.