Nothing Special   »   [go: up one dir, main page]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Don't issue tokens that have no scope #7

Open
jamietanna opened this issue Jun 26, 2020 · 1 comment
Open

Don't issue tokens that have no scope #7

jamietanna opened this issue Jun 26, 2020 · 1 comment

Comments

@jamietanna
Copy link

It appears that not providing a scope parameter returns different results based on which flow you're going through.

I used the following authorization URL:

https://indieauth.com/auth?redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fcallback&client_id=https%3A%2F%2Fwww-editor.jvt.me&state=production&response_type=code&me=https://www.jvt.me

After validating the authorization code:

{
    "me": "https://www.jvt.me/",
    "scope": null
}

After exchanging the authorization code:

{
    "me": "https://www.jvt.me/",
    "scope": "",
    "access_token": "(REDACTED)",
    "token_type": "Bearer"
}

And the body of the access token JWT:

{
  "typ": "JWT",
  "alg": "HS256"
}
{
  "me": "https://www.jvt.me/",
  "issued_by": "https://tokens.indieauth.com/token",
  "client_id": "https://www-editor.jvt.me",
  "issued_at": 1593188046,
  "scope": "",
  "nonce": 905775930
}
@aaronpk
Copy link
Owner
aaronpk commented Jun 26, 2020

hm, I think tokens.indieauth.com should probably just not issue a token that has no scope. I'm going to move this issue to that repo.

@aaronpk aaronpk transferred this issue from aaronpk/IndieAuth.com Jun 26, 2020
@aaronpk aaronpk changed the title Bug: inconsistency between scope handling for authorization code verification and authorization code exchange Don't issue tokens that have no scope Jun 26, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@aaronpk @jamietanna