bshaffer / oauth2-server-php

A library for implementing an OAuth2 Server in php
http://bshaffer.github.io/oauth2-server-php-docs
MIT License
3.26k stars 950 forks source link

Wrong token property check in OAuth2\Controller\ResourceController #838

Closed lukaslentner closed 7 years ago

lukaslentner commented 7 years ago

I think in OAuth2\Controller\ResourceController there is an error in line 83

            // Check token expiration (expires is a mandatory paramter)
            if (!$token = $this->tokenStorage->getAccessToken($token_param)) {
                $response->setError(401, 'invalid_token', 'The access token provided is invalid');
            } elseif (!isset($token["expires"]) || !isset($token["cid"])) { <<<<<<<<<<<<<<<<<<
                $response->setError(401, 'malformed_token', 'Malformed token (missing "expires")');
            } elseif (time() > $token["expires"]) {

I think it should not ask for cid but for client_id as this is the right property name for the client id in a access token...

Am I missing something?

Bye Lukas

lukaslentner commented 7 years ago

Sorry, my own mistake!