Store offline sessions only if they were requested by the user (dexid…

…p#3125) Signed-off-by: MM53 <2821Signed-off-by: MM53 <28218664+MM53@users.noreply.github.com> Signed-off-by: Pradeep Mudlapur <pradeep@juliacomputing.com>
mdpradeep · Oct 20, 2023 · 5829ba7 · 5829ba7
1 parent 450d407
commit 5829ba7
Show file tree

Hide file tree

Showing 2 changed files with 227 additions and 104 deletions.
diff --git a/server/handlers.go b/server/handlers.go
@@ -539,6 +539,17 @@ func (s *Server) finalizeLogin(identity connector.Identity, authReq storage.Auth
 		return returnURL, false, nil
 	}
 
+	offlineAccessRequested := false
+	for _, scope := range authReq.Scopes {
+		if scope == scopeOfflineAccess {
+			offlineAccessRequested = true
+			break
+		}
+	}
+	if !offlineAccessRequested {
+		return returnURL, false, nil
+	}
+
 	// Try to retrieve an existing OfflineSession object for the corresponding user.
 	session, err := s.storage.GetOfflineSessions(identity.UserID, authReq.ConnectorID)
 	if err != nil {