Store offline sessions only if they were requested by the user (dexid…

…p#3125) Signed-off-by: MM53 <2821Signed-off-by: MM53 <28218664+MM53@users.noreply.github.com>
orange-hbenmabrouk · Oct 23, 2023 · 84c9123 · 84c9123
1 parent 7309266
commit 84c9123
Show file tree

Hide file tree

Showing 2 changed files with 249 additions and 126 deletions.
diff --git a/server/handlers.go b/server/handlers.go
@@ -539,6 +539,17 @@ func (s *Server) finalizeLogin(identity connector.Identity, authReq storage.Auth
 		return returnURL, false, nil
 	}
 
+	offlineAccessRequested := false
+	for _, scope := range authReq.Scopes {
+		if scope == scopeOfflineAccess {
+			offlineAccessRequested = true
+			break
+		}
+	}
+	if !offlineAccessRequested {
+		return returnURL, false, nil
+	}
+
 	// Try to retrieve an existing OfflineSession object for the corresponding user.
 	session, err := s.storage.GetOfflineSessions(identity.UserID, authReq.ConnectorID)
 	if err != nil {