b1e994aa7e
Based on the OAuth 2.0 Token Introspection spec the "aud" field should be based on the token. Previously "aud" was populated with the id of the client making the introspection request which seems wrong. This changes the endpoint to return the value from the token. The "client_id" field is then changed to return the client id for the client that originally requested the token rather than returning the "aud" value from the token. From the spec https://tools.ietf.org/html/rfc7662: client_id OPTIONAL. Client identifier for the OAuth 2.0 client that requested this token. aud OPTIONAL. Service-specific string identifier or list of string identifiers representing the intended audience for this token, as defined in JWT [RFC7519]. |
||
|---|---|---|
| .. | ||
| test_authorize_endpoint.py | ||
| test_claims.py | ||
| test_commands.py | ||
| test_end_session_endpoint.py | ||
| test_introspection_endpoint.py | ||
| test_middleware.py | ||
| test_provider_info_endpoint.py | ||
| test_settings.py | ||
| test_token_endpoint.py | ||
| test_userinfo_endpoint.py | ||
| test_utils.py | ||