llvy.ltd/casdoor
1
0
Fork 0
mirror of https://github.com/casdoor/casdoor.git synced 2025-07-03 12:30:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: improve token introspection endpoint (#534)

Browse Source 
* feat: add introspection endpoint to oidc discovery endpoint

* fix: let introspect endpoint handle formData as spec define.

Signed-off-by: Leon <leondevlifelog@gmail.com>
This commit is contained in:
Leon
2022-03-04 08:54:33 +08:00
committed by GitHub
parent ab5af979c8
commit 178cf7945d
3 changed files with 7 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
controllers/token.go
View File

@ -237,12 +237,12 @@ func (c *ApiController) TokenLogout() {
// representing the meta information surrounding the
// token, including whether this token is currently active.
// This endpoint only support Basic Authorization.
// @Param body body {object.TokenIntrospectionRequest} true "the request body"
// @Param token formData string true "access_token's value or refresh_token's value"
// @Param token_type_hint formData string true "the token type access_token or refresh_token"
// @Success 200 {object} object.IntrospectionResponse The Response object
// @router /login/oauth/introspect [post]
func (c *ApiController) IntrospectToken() {
var body object.TokenIntrospectionRequest
err := json.Unmarshal(c.Ctx.Input.RequestBody, &body)
tokenValue := c.Input().Get("token")
clientId, clientSecret, ok := c.Ctx.Request.BasicAuth()
if !ok {
util.LogWarning(c.Ctx, "Basic Authorization parses failed")
@ -257,14 +257,14 @@ func (c *ApiController) IntrospectToken() {
c.ServeJSON()
return
}
token := object.GetTokenByTokenAndApplication(body.Token, application.Name)
token := object.GetTokenByTokenAndApplication(tokenValue, application.Name)
if token == nil {
util.LogWarning(c.Ctx, "application: %s can not find token", application.Name)
c.Data["json"] = &object.IntrospectionResponse{Active: false}
c.ServeJSON()
return
}
jwtToken, err := object.ParseJwtTokenByApplication(body.Token, application)
jwtToken, err := object.ParseJwtTokenByApplication(tokenValue, application)
if err != nil || jwtToken.Valid() != nil {
// and token revoked case. but we not implement
// TODO: 2022-03-03 add token revoked check, when we implemented the Token Revocation(rfc7009) Specs.