search

bshaffer / oauth2-server-php

A library for implementing an OAuth2 Server in php
http://bshaffer.github.io/oauth2-server-php-docs
MIT License
3.26k stars 950 forks source link

No option to return id_token on token refresh #976

Open dejan9393 opened 4 years ago

dejan9393 commented 4 years ago

Currently, the refresh_token grant_type does not return an id_token, even when the openid scope is provided. The OIDC spec states the following:

Upon successful validation of the Refresh Token, the response body is the Token Response of Section 3.1.3.3 except that it might not contain an id_token.

The spec goes on to mention what parts of the id_token need to remain the same as the old ID token. This suggests that it should be optional to return an ID token on a successful token refresh.

In its current state, i'm successfully refreshing my access tokens, and I can retrieve info about my users at the /userinfo endpoint, but any apps using the id_tokens directly might be getting outdated data.

bshaffer commented 4 years ago

This would require creeating a new Grant Type at src/OpenID/GrantType/RefreshToken.php, using this grant type instead when the openid option is set, and returning an id_token if desired.

adisazhar123 commented 4 years ago

Hi, is anyone working on this? I'd like to have a shot if this is needed. Thanks.

adisazhar123 commented 4 years ago

Would love your review on #982 @dejan9393 @bshaffer Thanks