feat: allow introspection and device code endpoints to use Federated Client Credentials #81

New Issue

AtHeartEngineer · 2025-07-08T08:39:14-04:00

AtHeartEngineer commented

2025-07-08 08:39:14 -04:00

Originally created by @ItalyPaleAle on 6/9/2025

Follow-up from #566 to complete the work started there

Add support for using federated client credentials to the introspection endpoint, to validate auth and refresh tokens. Calls to the endpoint use Authorization: Bearer <jwt> for authorization.
Add support for using federated client credentials to the device code endpoint
As part of that change, and for other reasons discussed on Discord, the refresh token's format has changed, and it's now a JWT containing the actual refresh code (stored in the DB, hashed), plus the ID of the client that uses it and the ID of the user it belongs to
- This is required because otherwise there's no way to know the client ID when introspecting a refresh token using federated client credentials
- It also allows more careful database lookups
- The RFC doesn't mandate anything about the format of refresh tokens, which are opaque strings for clients, so this remains fully-compliant

*Originally created by @ItalyPaleAle on 6/9/2025* Follow-up from #566 to complete the work started there - Add support for using federated client credentials to the introspection endpoint, to validate auth and refresh tokens. Calls to the endpoint use `Authorization: Bearer <jwt>` for authorization. - Add support for using federated client credentials to the device code endpoint - As part of that change, and for other reasons discussed on Discord, the refresh token's format has changed, and it's now a JWT containing the actual refresh code (stored in the DB, hashed), plus the ID of the client that uses it and the ID of the user it belongs to - This is required because otherwise there's no way to know the client ID when introspecting a refresh token using federated client credentials - It also allows more careful database lookups - The RFC doesn't mandate anything about the format of refresh tokens, which are opaque strings for clients, so this remains fully-compliant

AtHeartEngineer closed this issue

2025-07-08 08:39:14 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pocket-id#81