cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: improve error handling when getting ClientIDFromRequest

Browse source
This commit is contained in:
Livio Spring 2023-04-04 10:27:28 +02:00
parent edc9a1f60d
commit 1cda8f0a1f
No known key found for this signature in database
GPG key ID: 26BB1C2FA5952CF0
1 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

17
pkg/op/client.go
View file

@ -150,16 +150,25 @@ func ClientIDFromRequest(r *http.Request, p ClientProvider) (clientID string, au
}
JWTProfile, ok := p.(ClientJWTProfile)
if ok {
if ok && data.ClientAssertion != "" {
// if JWTProfile is supported and client sent an assertion, check it and use it as response
// regardless if it succeeded or failed
clientID, err = ClientJWTAuth(r.Context(), data.ClientAssertionParams, JWTProfile)
return clientID, err == nil, err
}
if !ok || errors.Is(err, ErrNoClientCredentials) {
clientID, err = ClientBasicAuth(r, p.Storage())
}
// try basic auth
clientID, err = ClientBasicAuth(r, p.Storage())
// if that succeeded, use it
if err == nil {
return clientID, true, nil
}
// if the client did not send a Basic Auth Header, ignore the `ErrNoClientCredentials`
// but return other errors immediately
if err != nil && !errors.Is(err, ErrNoClientCredentials) {
return "", false, err
}
// if the client did not authenticate (public clients) it must at least send a client_id
if data.ClientID == "" {
return "", false, oidc.ErrInvalidClient().WithParent(ErrMissingClientID)
}