Token Endpoint should respond with nocache headers

[gobengo]

Per OAuth2:

The authorization server MUST include the HTTP "Cache-Control"
   response header field [RFC2616] with a value of "no-store" in any
   response containing tokens, credentials, or other sensitive
   information, as well as the "Pragma" response header field [RFC2616]
   with a value of "no-cache".`

And OIDC:

All Token Responses that contain tokens, secrets, or other sensitive information MUST include the following HTTP response header fields and values:
Header Name Header Value
Cache-Control   no-store
Pragma  no-cache

But oic.oic.provider:Provider.token_endpoint does not set these headers. While I'm using 0.7.6, it also looks like the latest master branch is the same in this regard.

In my Provider, subclass, I created a decorator for token_endpoint to enforce this. Others may find it useful.

# HTTP headers required with successful token responses, per OAuth2 Spec
# https://tools.ietf.org/html/rfc6749#section-5.1
OAUTH2_NOCACHE_HEADERS = (
    ('Pragma', 'no-cache'),
    ('Cache-Control', 'no-store'),
)


def nocache_if_successful_token_response(token_endpoint):
    """
    Decorate Provider.token_endpoint to ensure compliance with
    https://tools.ietf.org/html/rfc6749#section-5.1
    by adding nocache response headers if needed
    """
    def wrapped(*args, **kwargs):
        response = token_endpoint(*args, **kwargs)
        return _ensure_token_response_nocache(response) or response
    return wrapped


def _ensure_token_response_nocache(response,
                                   required_headers=OAUTH2_NOCACHE_HEADERS):
    """
    Ensure a given token response is has no cache headers that it is required
    to have per the OAuth2 Spec. This mutates the provided response. :(

    The authorization server MUST include the HTTP "Cache-Control"
    response header field [RFC2616] with a value of "no-store" in any
    response containing tokens, credentials, or other sensitive
    information, as well as the "Pragma" response header field [RFC2616]
    with a value of "no-cache".

    :param response:
    :type response: oic.utils.http_util:Response
    :rtype: oic.utils.http_util:Response
    """
    successful = ( response.status == '200 OK' )
    contains_sensitive_info = ( '"access_token"' in response.message )
    if not (successful and contains_sensitive_info):
        # Doesn't need cache headers
        return response
    existing_headers = (h for h,v in response.headers)
    for header, value in OAUTH2_NOCACHE_HEADERS:
        # Only set headers if they weren't already set
        if header not in existing_headers:
            response.headers.append((header, value))
    return response

from oic.oic.provider import Provider
class MyProvider(Provider):
    @nocache_if_successful_token_response
    def token_endpoint(self, *args, **kwargs):
        response = super(MyProvider, self).token_endpoint(*args, **kwargs)
        return response

I'm not in a position to make a tested PR right away, but will strive to upstream some things like this once my subclass is polished a bit.

[gobengo]

Props to @tpazderka !