Skip to content

Restrict token introspection to access and refresh tokens #4985

Description

@thiva-k

Description

/oauth2/introspect reports any unexpired JWT signed by this server as active: true, not just OAuth tokens. ValidateToken verifies the signature and time claims but checks no typ header, no issuer, and no token-type-specific claims, so ID tokens, flow authentication assertions, and ID-JAG assertions all introspect as active.

RFC 7662 Section 2.1 scopes introspection to access and refresh tokens; other token types are outside the specification. A resource server that trusts an active: true response could accept a token that was never intended as a credential for it, for example an ID token issued to the client rather than to the resource server.

Steps to Reproduce

  1. Register a confidential client with the authorization_code grant and the openid scope.
  2. Complete an authorization code flow and keep the id_token from the token response.
  3. Call POST /oauth2/introspect with token=<id_token>, authenticating as the client.
  4. The response is {"active": true, "token_type": "Bearer", ...}. The same holds for a flow authentication assertion JWT.

Version

1.0.0

Environment Details (with versions)

No response

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions