andwati/zitadel
1
0
Fork 0
mirror of https://github.com/andwati/zitadel.git synced 2026-11-03 04:42:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(oidc): only return state in access token response for implicit flow (#8108)

Browse Source 
# Which Problems Are Solved

Introduced with #7822 the access token response incorrectly returned the
`state` parameter.

# How the Problems Are Solved

The `state` will only be returned for access token responses in an
implicit_flow.

# Additional Changes

None.

# Additional Context

- relates to #7822 
- relates to
https://github.com/zitadel/oidc/issues/446#issuecomment-2144999644
- backport to 2.53.x

---------

Co-authored-by: Tim Möhlmann <[email protected]>
This commit is contained in:
Livio Spring
2024-06-12 11:53:56 +00:00
committed by GitHub
co-authored by Tim Möhlmann
parent f4d32d98d3
commit fb95f4a8a2
2 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/oidc/auth_request_integration_test.go
+3
View File
@@ -528,6 +528,9 @@ func assertTokens(t *testing.T, tokens *oidc.Tokens[*oidc.IDTokenClaims], requir
} else {
assert.Empty(t, tokens.RefreshToken)
}
// since we test implicit flow directly, we can check that any token response must not
// return a `state` in the response
assert.Empty(t, tokens.Extra("state"))
}
func assertIDTokenClaims(t *testing.T, claims *oidc.IDTokenClaims, userID string, arm []string, sessionStart, sessionChange time.Time, sessionID string) {