Uploaded image for project: 'CXF'
  1. CXF
  2. CXF-8311

OAuth 2.0: Refresh token redemption unexpectedly fails with invalid_grant error

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Fixed
    • 3.3.7
    • 3.4.0, 3.3.8
    • JAX-RS Security
    • None
    • Unknown

    Description

      Scenario:

      1. Get an access and refresh tokens for a client with less scopes than the client allows, e.g. if there are scopes scope1 and scope2 registered for the client the authorization request should contain only scope1 (or only scope2)
      2. Try to redeem refresh token without providing scope parameter in the token request.

      Request fails with invalid_grant error which is against OAuth specification.

      Attachments

        Activity

          People

            coheigea Colm O hEigeartaigh
            romanu Roman Usatenko
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: