overture-stack / ego

OAuth 2.0 authorization service that supports multiple OpenID identity providers
https://www.overture.bio/products/ego
GNU Affero General Public License v3.0
26 stars 14 forks source link

check_api_key operation is not returning 401 error code in expired apiKeys #725

Open leoraba opened 1 year ago

leoraba commented 1 year ago

Description

Operation POST /o/check_api_key is expected to check if an apiKey is valid or not. It should return an error whenever an apiKey is not valid or is expired.

Expected Behaviour

Returns a 401 Unauthorized when using an expired apiKey

Actual Behaviour

returns a 200 OK with exp field 0 e.g. { "user_name": "john.doe@example.com", "client_id": "song", **"exp": 0**, "scope": [ "song.READ", "song.WRITE" ] }