-
-
Notifications
You must be signed in to change notification settings - Fork 358
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
During refresh token grant if token is invalid or expired return status code should be 400 #747
Comments
Users implementing their own storage interface implementation should realistically carefully model their implementation similar to the memory example as this is often used in the testing. You will notice that upon inspection that the Other errors are usually indicative of SQL errors and the like. I can see an argument for enhancing this interaction (globally) where if the error is a |
Please note that returning
|
Bumping this issue, I've also observed that Ory returns a 401 and Happy to write a test and a more complete/fleshed out issue for this if you agree that this is a bug. |
Preflight checklist
Describe the bug
Issue when you implement revocation with your own
TokenRevocationStorage
.The grant type
refresh_token
used to refresh and access the token should returns errors as specified in RFC.The refresh token handler should return a
400
status code error for an invalid, expired, or revoked refresh token, or anErrInvalidGrant
error for Fostie. However, it currently fails to account for this scenario. As a result, if theTokenRevocationStorage
methodGetRefreshTokenSession
implementation returnsfosite.ErrInvalidGrant
, it will be converted into a 500 error.The workaround, for now, is to return
fosite.ErrNotFound
from theGetRefreshTokenSession
implementation which is then converted tofosite.ErrInvalidGrant
in the handler.Reproducing the bug
This setup for this would require a lot more than a simple step. As such I am keeping it abstract Implement the
TokenRevocationStorage
interface and fromGetRefreshTokenSession
returnfosite.ErrInvalidGrant
.Relevant log output
No response
Relevant configuration
No response
Version
v0.42.2
On which operating system are you observing this issue?
Linux
In which environment are you deploying?
Kubernetes with Helm
Additional Context
No response
The text was updated successfully, but these errors were encountered: