When the token type hint parameter is incorrect, we now fall back and try the other type of token (either refresh or access). But, we only do this for clients - apis cannot use refresh tokens, so they still get a response of { "isActive": false } if they attempt to introspect a refresh token. In either case, bogus token_type_hints are not an error anymore, either.
For reference, RFC 7662 Section 2.1:
If the server is unable to locate the token using the given hint, it MUST extend its search across all of its supported token types.
When the token type hint parameter is incorrect, we now fall back and try the other type of token (either refresh or access). But, we only do this for clients - apis cannot use refresh tokens, so they still get a response of { "isActive": false } if they attempt to introspect a refresh token. In either case, bogus token_type_hints are not an error anymore, either.
For reference, RFC 7662 Section 2.1:
Resolves #1578