Description
/oauth2/introspect reports any unexpired JWT signed by this server as active: true, not just OAuth tokens. ValidateToken verifies the signature and time claims but checks no typ header, no issuer, and no token-type-specific claims, so ID tokens, flow authentication assertions, and ID-JAG assertions all introspect as active.
RFC 7662 Section 2.1 scopes introspection to access and refresh tokens; other token types are outside the specification. A resource server that trusts an active: true response could accept a token that was never intended as a credential for it, for example an ID token issued to the client rather than to the resource server.
Steps to Reproduce
- Register a confidential client with the
authorization_code grant and the openid scope.
- Complete an authorization code flow and keep the
id_token from the token response.
- Call
POST /oauth2/introspect with token=<id_token>, authenticating as the client.
- The response is
{"active": true, "token_type": "Bearer", ...}. The same holds for a flow authentication assertion JWT.
Version
1.0.0
Environment Details (with versions)
No response
Description
/oauth2/introspectreports any unexpired JWT signed by this server asactive: true, not just OAuth tokens.ValidateTokenverifies the signature and time claims but checks notypheader, no issuer, and no token-type-specific claims, so ID tokens, flow authentication assertions, and ID-JAG assertions all introspect as active.RFC 7662 Section 2.1 scopes introspection to access and refresh tokens; other token types are outside the specification. A resource server that trusts an
active: trueresponse could accept a token that was never intended as a credential for it, for example an ID token issued to the client rather than to the resource server.Steps to Reproduce
authorization_codegrant and theopenidscope.id_tokenfrom the token response.POST /oauth2/introspectwithtoken=<id_token>, authenticating as the client.{"active": true, "token_type": "Bearer", ...}. The same holds for a flow authentication assertion JWT.Version
1.0.0
Environment Details (with versions)
No response