Introspection endpoint reads token from query-parameters
Basics
Logistics
Basics
Logistics
Description
@Pasquale Barbaro reported that the OP’s introspection endpoint also accepts the token from query parameters. It should only read them from the parameters sent as "application/x-www-form-urlencoded” data, see section 2.1 in [1].
We still rely heavily on Nimbus for decoding request messages. The bug has been reported at [2]. As it’s the holiday season, the fix may take some time though. If that’s the case, we may want to fix it ourselves in OAuth2IntrospectionRequestDecoder
@Pasquale Barbaro reported that the OP’s introspection endpoint also accepts the token from query parameters. It should only read them from the parameters sent as "application/x-www-form-urlencoded” data, see section 2.1 in [1].
We still rely heavily on Nimbus for decoding request messages. The bug has been reported at [2]. As it’s the holiday season, the fix may take some time though. If that’s the case, we may want to fix it ourselves in OAuth2IntrospectionRequestDecoder
[1 ]RFC 7662: OAuth 2.0 Token Introspection
[2] https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/issues/432