search

IdentityServer / IdentityServer4.AccessTokenValidation

IdentityServer Access Token Validation for ASP.NET Core
Apache License 2.0
544 stars 214 forks source link

RequireHttpsMetadata only used for JWT #77

Closed thijscrombeen closed 7 years ago

thijscrombeen commented 7 years ago

Is it by design that RequireHttpsMetadata is only used when dealing with JWT tokens?

In case of Reference Tokens this property is not used. The following error is returned: InvalidOperationException: Error parsing discovery document from http://identity-server.local:8080/.well-known/openid-configuration: Error connecting to http://identity-server.local:8080/.well-known/openid-configuration: HTTPS required

I guess this is simple solved by adding: introspectionOptions.DiscoveryPolicy.RequireHttps = RequireHttpsMetadata;

Thanks,

leastprivilege commented 7 years ago

Good point. Done on dev.