Skip to main content

authenticate_introspecting_client

headless_lms_server::controllers::main_frontend::oauth::introspect

Function authenticate_introspecting_client 

Source 
async fn authenticate_introspecting_client(
    conn: &mut PgConnection,
    form: &IntrospectParams,
    token_hmac_key: &SecretString,
) -> Result<OAuthClient, ControllerError>
Expand description

Authenticate the caller of the introspection endpoint.

Only a confidential client may introspect (RFC 7662 §2.1: the endpoint MUST be protected). A public client id is not a credential — tmc-vscode’s is hardcoded in the extension — so accepting one turned the endpoint into a validity-and-owner oracle for any leaked token, callable with no secret at all.

An unknown client_id, a public client, or a bad secret is 401 invalid_client (§2.3). Only the token’s validity is reported as 200 {"active": false}: folding failed client authentication into that answer makes a caller’s credential typo indistinguishable from every one of its users holding an inactive token.