search

ncsa / oa4mp

Open Authorization for MyProxy
https://oa4mp.org/
Other
7 stars 10 forks source link

Refresh endpoint must check for required refresh token #166

Closed jjg-123 closed 2 months ago

jjg-123 commented 7 months ago

The OAuth 2 spec (https://www.rfc-editor.org/rfc/rfc6749#page-47) asserts in section 6 that the refresh token is required. The code should check for this explicitly and fail outright.