andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-10-31 19:42:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
* fix: client_id verification during code exchange and refresh token flows

* add clientID check for device token flow

* Trigger Build
This commit is contained in:
Gayathri Vijayan
2026-06-16 15:19:56 +02:00
committed by GitHub
parent e94d4c3986
commit 0973b074b4
8 changed files with 257 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/oidc/token_code.go
+7
View File
@@ -62,6 +62,10 @@ func (s *Server) codeExchangeV1(ctx context.Context, client *Client, req *oidc.A
return nil, err
}
if authReq.GetClientID() != client.client.ClientID {
return nil, oidc.ErrInvalidClient().WithDescription("client_id does not correspond to the client_id in the authorization request")
}
if challenge := authReq.GetCodeChallenge(); challenge != nil || client.AuthMethod() == oidc.AuthMethodNone {
if err = op.AuthorizeCodeChallenge(req.CodeVerifier, challenge); err != nil {
return nil, err
@@ -121,6 +125,9 @@ func (s *Server) getAuthRequestV1ByID(ctx context.Context, id string) (*AuthRequ
func codeExchangeComplianceChecker(client *Client, req *oidc.AccessTokenRequest) command.AuthRequestComplianceChecker {
return func(ctx context.Context, authReq *command.AuthRequestWriteModel) error {
if authReq.ClientID != client.client.ClientID {
return oidc.ErrInvalidClient().WithDescription("client_id does not correspond to the client_id in the authorization request")
}
if authReq.CodeChallenge != nil || client.AuthMethod() == oidc.AuthMethodNone {
err := op.AuthorizeCodeChallenge(req.CodeVerifier, CodeChallengeToOIDC(authReq.CodeChallenge))
if err != nil {