limosa-io / openid-connect-server

This is an OpenID Connect Server written in PHP.
GNU Affero General Public License v3.0
46 stars 9 forks source link

Requested "claims" are lost when access token is refreshed #21

Open RobertMe opened 1 year ago

RobertMe commented 1 year ago

When authenticating the claims are stored using the access token id. But when later on using the refresh token to request a new access token (for example because the current token has expired) than the claims aren't copied over. This thus means that the userinfo endpoint (which uses the claims value) won't show (all) requested claims anymore.