Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OAuth2Client: use correct auth method for token introspection #662

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

OAuth2Client: use correct auth method for token introspection #662

wants to merge 1 commit into from

Commits on Jul 19, 2024

  1. OAuth2Client: use correct auth method for token introspection 

    When token introspection was introduced in 6f5d19a, using the
code that previously only handled token revocation, the new
`_handle_token_hint` method that does the work for both
`introspect_token` and `revoke_token` kept using
`self.revocation_endpoint_auth_method` unconditionally if no
`auth` was passed in with the introspect or revoke request.
This seems to be wrong, introspecting a token should use the
`token_endpoint_auth_method`.

This leaves the fallback to `revocation_endpoint_auth_method`
in `_handle_token_hint` because adjusting its signature to make
`auth` compulsory would be awkward, but it's not expected ever
to be used.

Signed-off-by: Adam Williamson <[email protected]>
    @AdamWill
    AdamWill committed Jul 19, 2024
    Configuration menu
    Copy the full SHA
    7cadb79 View commit details
    Browse the repository at this point in the history