Introspection #217
Merged
Introspection #217
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ken Introspection Spec being incorporated into IndieAuth
jamietanna
reviewed
Sep 11, 2021
jamietanna
reviewed
Sep 11, 2021
| $tokens->update( $token, $return ); | ||
| if ( array_key_exists( 'exp', $return ) ) { |
There was a problem hiding this comment.
🔧 to reduce the diff noise this could be moved up to where it was
jamietanna
reviewed
Sep 11, 2021
It checks for the old parameter and uses it as well, for the migration. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
As per indieweb/indieauth#33, we're adopting the response used by the Token Introspection specification. This means the properties I used, which were internal only, 'expiration' and 'issued_at' should be changed to 'iat' and 'exp' to match. While I could just change them on the response, there was no reason to retain the old structure.
I also changed expires_in to no longer be stored. It is generated only on return, as there is no need to store it.
While the return parameters of the GET token verification are amended, it still, like the original spec, returns a 400 series error for backward compatibility. The new introspection endpoint, which is a POST request, always returns a 200. At some point when clients have caught up, will likely adjust accordingly.
There is a slight reformatting of the POST action handler, which now uses two switch statements, one for action, the other for grant_type=. The reason for this is somewhat practical.
For grant_type, we only support 1 right now, but the new amendment decided at the popup was to include refresh_tokens as a recommendation in the spec(indieweb/indieauth#81) so there would be a new grant_type, which I intend to submit as a separate PR. In indieweb/indieauth#87, @Zegnat proposes extending action as part of the Ticket Auth proposal, so might as well structure for that as well.