Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

revocation_endpoint only works with JWT Tokens #818

Open
schlenk opened this issue Jun 21, 2022 · 0 comments
Open

revocation_endpoint only works with JWT Tokens #818

schlenk opened this issue Jun 21, 2022 · 0 comments
Labels

Comments

@schlenk
Copy link
Collaborator

schlenk commented Jun 21, 2022

The oic.extensions.provider revocation endpoint tries to load the details of the token to revoke and fails to revoke it, if it is not an JWT token. RFC 7009 does not demand the format of the token to be JWT.

At first, the get_info call will fail, because DefaultToken does not implement it:
https://github.com/OpenIDC/pyoidc/blob/64c5e3b6c099496787093a778fbc8b0d7e044e1d/src/oic/extension/provider.py#L776

And even if that works, the token_access method will block the revocation, as it requires JWT attributes:
https://github.com/OpenIDC/pyoidc/blob/64c5e3b6c099496787093a778fbc8b0d7e044e1d/src/oic/extension/provider.py#L720

@schlenk schlenk added the bug label Jun 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant