id_token is processed and stored during refresh token flow when AuthConfig.oidc = false #1254
Labels
bug
For tagging faulty or unexpected behavior.
investigation-needed
Indication that the maintainer or involved community members may need to investigate more.
Uh oh!
There was an error while loading. Please reload this page.
Describe the bug
I use Authorization Code flow with refresh_token. Id provider also returns an id_token, but I don't need it, so I set
AuthConfig.oidc = false
and useoauthService.tryLogin()
instead ofoauthService.loadDiscoveryDocumentAndTryLogin()
.id_token is not processed and stored during initial authorization_code flow, but surprisingly is processed and stored during all subsequent refresh_token flows (in case of loadDiscoveryDocumentAndTryLogin()) or the exception "Parameter jwks expected!" is thrown (in case of tryLogin()).
The cause is that this.oidc is checked in fetchTokenUsingGrant() and fetchAndProcessToken() functions
but not in refreshToken()
Expected behavior
id_token to be NOT processed and stored during refresh token flow when AuthConfig.oidc = false
Desktop (please complete the following information):
The text was updated successfully, but these errors were encountered: