
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
angular-oauth1-client
Advanced tools
An OAuth1.0a client for AngularJS and Cordova/Ionic
$ bower install angular-oauth1-client
Make sure to include these in your index.html
:
For example, index.html
:
<script src="lib/underscore/underscore-min.js"></script>
<script src="lib/cryptojslib/rollups/hmac-sha1.js"></script>
<script src="lib/cryptojslib/components/enc-base64-min.js"></script>
<script src="lib/angular-local-storage/dist/angular-local-storage.min.js"></script>
<script src="lib/angular-oauth1-client/dist/angular-oauth1-client.min.js"></script>
Make sure to install the cordova-plugin-inappbrowser
plugin:
$ ionic plugin add cordova-plugin-inappbrowser
or
$ cordova plugin add cordova-plugin-inappbrowser
First you need to configure oauth1Client with your API data. Include oauth1Client as a dependency in your app definition:
angular.module('myModule', [
'oauth1Client'
])
.config(function(oauth1ClientProvider) {
oauth1ClientProvider.config({
consumerKey: '~~YOUR~CONSUMER~KEY~~',
consumerSecret: '~~YOUR~CONSUMER~SECRET~~',
requestEndpoint: 'http://localhost/wordpress/oauth1/request',
authorizeEndpoint: 'http://localhostwordpress/oauth1/authorize',
accessEndpoint: 'http://localhost/wordpress/oauth1/access',
oauthCallback: 'http://www.google.com'
});
})
Then start the authorization flow in your controller. This will open up the InAppBrowser and ask the user to approve your app's access:
var authorizationProcess = oauth1Client.authorize();
After authorization, you are returned a wrapper around angular's $http that takes the same parameters and configs, but adds the OAuth authorization information to it:
authorizationProcess.then(function(authorizedHttp) {
authorizedHttp({
method: "POST",
url: "http://localhost/wordpress/wp-json/users",
data: {
username: "User 2",
name: "User 2",
password: "User 2's Password",
email: "email2@email.com"
}
})
.then(function(response) {
alert("New user created!");
}, function(response) {
alert("Error! " + response.data);
});
authorizedHttp({
method: "GET",
url: "http://localhost/wordpress/wp-json/users/me"
})
.then(function(response) {
alert("Success! " + JSON.stringify(response));
},
function(response) {
alert("Error! " + JSON.stringify(response));
});
});
If you are using the Wordpress WP-API you will need to set up the OAuth 1.0a server on your instance. See setup instructions at the WP REST API - OAuth 1.0a Server page.
Some things to note:
CORS
support - You will most likely need to enable CORS support on your Wordpress API. For development, a library by thenbrent
will provide CORS support. As mentioned there, you will probably want to harden your server more in production.deviceready
event - This plugin makes use of the Cordova InAppBrowser plugin. Cordova plugins only work when the deviceready
event fires. See the plugin README for more details.http://localhost
when you aren't running anything on localhost
or it isn't accessible from the iOS simulator.FAQs
An OAuth1.0a client for AngularJS and Cordova/Ionic
The npm package angular-oauth1-client receives a total of 2 weekly downloads. As such, angular-oauth1-client popularity was classified as not popular.
We found that angular-oauth1-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.