There are a few issues with the bootstrapping at the moment:
current_user.id() returns string, and .client_id returns an int. This line is never checked, so bootstrap is serving tokens for the same session cookie, continuously.
oauth_client is not removed from the session when someone logs out. This shouldn't be left dangling
Everytime bootstrap is accessed, the oauth_client is checked even if there is no oauth_client in the session. This means there is database access everytime - this is not needed.
I have fixes in place, this ticket is purely for reference. See relevant PR when it is opened.
There are a few issues with the bootstrapping at the moment:
I have fixes in place, this ticket is purely for reference. See relevant PR when it is opened.