Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Why are scope query params used at the token endpoint?

See original GitHub issue

When grant_type is authorization_code and refresh_token the scope was declared in the auth request, and is already associated with the token, hence token.code should be used to create the id token, not self.params['scope']. See https://github.com/juanifioren/django-oidc-provider/blob/v0.5.x/oidc_provider/lib/endpoints/token.py#L203

Issue Analytics

State:
Created 6 years ago
Reactions:1
Comments:9 (3 by maintainers)

Top GitHub Comments

1reaction

suutari-aicommented, Jul 7, 2017

Yep, for the password grant type it seems to be correct to use the scope provided to the token endpoint. Only problem with that in the current implementation is that the scope parameter is not splitted correctly when passed to create_id_token, i.e. "openid email" is being passed but correct would be ["openid", "email"].

1reaction

wojtek-fliposportscommented, Jul 5, 2017

I can agree. Scope should be taken from first auth request, when checking consents. Can You provide some PR with tests for this ? If not, I will fix this asap and ask @juanifioren to release this security fix