Fall back to other token types when given incorrect hint during introspection #1607
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When the token type hint parameter is incorrect, we now fall back and try the other type of token (either refresh or access). But, we only do this for clients - apis cannot use refresh tokens, so they still get a response of { "isActive": false } if they attempt to introspect a refresh token. In either case, bogus token_type_hints are not an error anymore, either.
For reference, RFC 7662 Section 2.1:
> If the server is unable to locate the token using the given hint, it MUST extend its search across all of its supported token types.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
src/IdentityServer/Validation/Default/IntrospectionRequestValidator.cs
Fixed
Show resolved
Hide resolved
Brock and I discussed this, and we don't want to change default behavior here because there could be scenarios where you want to introspect a token even though you're not really "consuming" it (maybe some kind of gateway). And you can do this today via a decorator on the introspection request validator
brockallen
approved these changes
Sep 27, 2024
josephdecock
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When the token type hint parameter is incorrect, we now fall back and try the other type of token (either refresh or access). But, we only do this for clients - apis cannot use refresh tokens, so they still get a response of { "isActive": false } if they attempt to introspect a refresh token. In either case, bogus token_type_hints are not an error anymore, either.
For reference, RFC 7662 Section 2.1:
Resolves #1578