Running convert-token for the second time returns html headers with user environment variables

[snowcrash-arin]

Running convert-token for the second time returns html headers with user environment variables

[snowcrash-arin]

To add more details, running convert_token a second time with a different backend token doesn't yield the same result. The issue only happens when running for the second time with the same backend token.

[fahedmahidi]

To add even more details : the second request fails.

[wagnerdelima]

Guys, you are clearly not reading the docs. This package has almost 12k downloads a month. Surely I have misconfigured the settings.

[snowcrash-arin]

@wagnerdelima Can you provide details on which settings were misconfigured and confirm if you were able to replicate the issue? Just fyi, this behavior happens not only from curl, but also on the DRF API page.

[wagnerdelima]

@snowcrash-arin that's my concern exactly. I was not able to replicate the issue.

[wagnerdelima]

@fahedmahidi @snowcrash-arin FYI:
I completely misread this issue. In your instructions, you added "Run curl with -i parameter(-i shows header contents)". Yes, it will add the headers in the response because you are passing -i:

[snowcrash-arin]

@fahedmahidi @snowcrash-arin FYI: I completely misread this issue. In your instructions, you added "Run curl with -i parameter(-i shows header contents)". Yes, it will add the headers in the response because you are passing -i:

Hi @wagnerdelima

If you look at the screenshot, it shows user environments, not just the headers, which is security concern. Additionally, I made note of the fact that this issue is occurring on the DRF API page.

[wagnerdelima]

@snowcrash-arin what do you mean by "DRF API page"?

[wagnerdelima]

I am investigating this issue @snowcrash-arin. So far I have got no clue on how to solve it. Any ideas will be welcome.

[wagnerdelima]

@snowcrash-arin @fahedmahidi I believe this is fixed now. Please retest it with the latest published version 2.1.1.

Also, check the newly published readthedocs page: https://drf-social-oauth2.readthedocs.io/en/latest/

[snowcrash-arin]

Thanks @wagnerdelima! I'll test it and let you know sometime this month. I stopped working on it due to the security concern.

[wagnerdelima]

@snowcrash-arin please do! Let me know :)