$ show openshift/osin
OSIN is a Go library implementing an OAuth 2.0 authorization server as defined in RFC 6749, with support for PKCE (RFC 7636). It provides a modular server with configurable storage backends, token generators, and client authentication. The library handles all standard grant types: authorization code, implicit, resource owner password credentials, client credentials, refresh token, and assertion. It also includes non-standard info endpoints. The architecture is centered around a `Server` struct with pluggable `Storage` and token generator interfaces. Key entry points are `HandleAuthorizeRequest`, `HandleAccessRequest`, and `HandleInfoRequest`, which users integrate into their HTTP handlers. The code is well-structured and tested, but the project is in maintenance-only mode with outdated dependencies (e.g., jwt-go v3, jose.v1) and no recent commits. It remains a solid reference implementation for OAuth2 server logic in Go.
The LLM identified 4 files worth highlighting for reuse:
Provides robust OAuth 2.0 redirect URI validation with support for multiple registered URIs, loopback IP addresses (IPv4/IPv6), handling of path traversals, and proper URL normalization. Isolated and reusable for any OAuth2 implementation or URI validation task.
Contains HTTP authentication header parsers for Basic and Bearer schemes, including URL-decoded credentials as per RFC 6749 Section 2.3.1. Also provides helper functions for client authentication and secret verification. Self-contained and directly usable in any HTTP service needing credential extraction.
Implements the Response struct with correct handling of OAuth 2.0 redirect responses, including encoding parameters in the URI fragment for implicit grant flows per RFC 6749 Section 4.2.2. The GetRedirectUrl method correctly constructs the redirect URL with application/x-www-form-urlencoded encoding in fragments. Create a reusable component for any OAuth2 response building.
Defines the Client interface and DefaultClient implementation with support for a ClientSecretMatcher interface that allows clients to securely compare secrets without exposing the plaintext secret via GetSecret. This is a well-considered pattern for secure credential handling in authorization frameworks.