[x] Provide a fix, but I would like to have a review/confirmation from @thomasvargiu
The bug has been discovered by my colleage @ileanatudoran, props to her!
How to reproduce the issue?
When you want to introspect the access token using client_secret_jwt, the IntrospectionService seems to be your friend.
Inside IntrospectionService::introspect(), the ClientSecretJwt AuthMethodInterface calls AbstractJwtAuth::createRequest()
There is a missing & betweem the original request body client_assertion=tokenvalue&client_id=value1&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer and token=token.
This PR:
The bug has been discovered by my colleage @ileanatudoran, props to her!
How to reproduce the issue?
When you want to introspect the access token using
client_secret_jwt
, theIntrospectionService
seems to be your friend. InsideIntrospectionService::introspect()
, theClientSecretJwt AuthMethodInterface
callsAbstractJwtAuth::createRequest()
and do:
Then, that
$request
object is returned back inIntrospectionService::introspect()
and the body of the$request
is modified:The issue is when we do:
By using the
write()
method, it will append the generated query string to the$request
body.So, you could end up having a request body as such:
client_assertion=tokenvalue&client_id=value1&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearertoken=token
There is a missing
&
betweem the original request bodyclient_assertion=tokenvalue&client_id=value1&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
andtoken=token
.