
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
reddit-oauth-pass-refresh
Advanced tools
Reddit API wrapper with both OAuth and username/password authentication, updated to refresh even when username and password are used
reddit-oauth-pass-refresh is a wrapper around the Reddit API providing both OAuth and password authentication.
It adds on to the original reddit-oauth by refreshing the access token after expiration even when authenticating with username and password.
npm install reddit-oauth-pass-refresh
Original documentation:
http://aiham.github.io/reddit-oauth
var RedditApi = require('reddit-oauth');
var reddit = new RedditApi({
app_id: 'your_app_id',
app_secret: 'your_app_secret',
redirect_uri: 'your_app_redirect_uri'
});
// Authenticate with username/password
reddit.passAuth(
'your_reddit_username',
'your_reddit_password',
function (success) {
if (success) {
// Print the access token we just retrieved
console.log(reddit.access_token);
}
}
);
// Get the OAuth URL to redirect users to
// Scopes are defined here: https://github.com/reddit/reddit/wiki/OAuth2
reddit.oAuthUrl('some_state', 'identity');
// After the user is redirected back to us, grab the query string
// object and exchange it for a set of access and refresh tokens.
// Scope has to be identical as the one provided to oAuthUrl. Can
// change for each authentication attempt.
reddit.oAuthTokens(
'some_state',
request.query,
function (success) {
// Print the access and refresh tokens we just retrieved
console.log(reddit.access_token);
console.log(reddit.refresh_token);
}
);
// Returns true if access token exists
reddit.isAuthed();
// Force a refresh of the access token using the refresh token
reddit.refreshToken(
function (success) {
// Print the access token we just retrieved
console.log(reddit.access_token);
}
);
// Call authenticated GET endpoint
reddit.get(
'/api/v1/me',
{},
function (error, response, body) {
console.log(error);
console.log(body);
}
);
// Call authenticated GET listing endpoint with easy pagination
reddit.get(
'/user/aihamh/submitted',
{},
function (error, response, body, next) {
console.log(error);
console.log(body);
// next is not null, therefore there are more pages
if (next) {
next(); // Invoke next to retrieve the next page
}
}
);
// Call authenticated POST endpoint
reddit.post(
'/api/comment',
{
api_type: 'json',
text: 'Hello World!',
thing_id: 'abc123'
},
function (error, response, body) {
console.log(error);
console.log(body);
}
);
Tests written with mocha.
Copy test/config.template.json
to test/config.json
and add your own app and user credentials. Then run:
npm test
Documentation can be generated with jsdoc by running:
npm run docs
FAQs
Reddit API wrapper with both OAuth and username/password authentication, updated to refresh even when username and password are used
The npm package reddit-oauth-pass-refresh receives a total of 0 weekly downloads. As such, reddit-oauth-pass-refresh popularity was classified as not popular.
We found that reddit-oauth-pass-refresh demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.