mirror of
https://github.com/pfzetto/axum-oidc.git
synced 2024-11-29 14:44:34 +01:00
Merge Pull Request #5 "feat: Handle Grant error while refreshing token"
Expired refresh_tokens weren't removed from the session causing a 500 Internal Server Error. This PR removes the invalid request token when it is expired.
This commit is contained in:
commit
8d0be319ad
1 changed files with 50 additions and 33 deletions
|
@ -15,9 +15,12 @@ use tower_service::Service;
|
||||||
use tower_sessions::Session;
|
use tower_sessions::Session;
|
||||||
|
|
||||||
use openidconnect::{
|
use openidconnect::{
|
||||||
core::CoreAuthenticationFlow, reqwest::async_http_client, AccessTokenHash, AuthorizationCode,
|
core::{CoreAuthenticationFlow, CoreErrorResponseType},
|
||||||
CsrfToken, Nonce, OAuth2TokenResponse, PkceCodeChallenge, PkceCodeVerifier, RedirectUrl, Scope,
|
reqwest::async_http_client,
|
||||||
TokenResponse,
|
AccessTokenHash, AuthorizationCode, CsrfToken, Nonce, OAuth2TokenResponse, PkceCodeChallenge,
|
||||||
|
PkceCodeVerifier, RedirectUrl,
|
||||||
|
RequestTokenError::ServerResponse,
|
||||||
|
Scope, TokenResponse,
|
||||||
};
|
};
|
||||||
|
|
||||||
use crate::{
|
use crate::{
|
||||||
|
@ -343,19 +346,21 @@ where
|
||||||
refresh_request.add_scope(Scope::new(scope.to_string()));
|
refresh_request.add_scope(Scope::new(scope.to_string()));
|
||||||
}
|
}
|
||||||
|
|
||||||
let token_response =
|
match refresh_request.request_async(async_http_client).await {
|
||||||
refresh_request.request_async(async_http_client).await?;
|
Ok(token_response) => {
|
||||||
|
|
||||||
// Extract the ID token claims after verifying its authenticity and nonce.
|
// Extract the ID token claims after verifying its authenticity and nonce.
|
||||||
let id_token = token_response
|
let id_token = token_response
|
||||||
.id_token()
|
.id_token()
|
||||||
.ok_or(MiddlewareError::IdTokenMissing)?;
|
.ok_or(MiddlewareError::IdTokenMissing)?;
|
||||||
let claims = id_token
|
let claims = id_token.claims(
|
||||||
.claims(&oidcclient.client.id_token_verifier(), &login_session.nonce)?;
|
&oidcclient.client.id_token_verifier(),
|
||||||
|
&login_session.nonce,
|
||||||
|
)?;
|
||||||
|
|
||||||
// Verify the access token hash to ensure that the access token hasn't been substituted for
|
// Verify the access token hash to ensure that the access token hasn't been substituted for
|
||||||
// another user's.
|
// another user's.
|
||||||
if let Some(expected_access_token_hash) = claims.access_token_hash() {
|
if let Some(expected_access_token_hash) = claims.access_token_hash()
|
||||||
|
{
|
||||||
let actual_access_token_hash = AccessTokenHash::from_token(
|
let actual_access_token_hash = AccessTokenHash::from_token(
|
||||||
token_response.access_token(),
|
token_response.access_token(),
|
||||||
&id_token.signing_alg()?,
|
&id_token.signing_alg()?,
|
||||||
|
@ -376,6 +381,18 @@ where
|
||||||
parts.extensions.insert(OidcAccessToken(
|
parts.extensions.insert(OidcAccessToken(
|
||||||
login_session.access_token.clone().unwrap_or_default(),
|
login_session.access_token.clone().unwrap_or_default(),
|
||||||
));
|
));
|
||||||
|
}
|
||||||
|
Err(ServerResponse(e))
|
||||||
|
if *e.error() == CoreErrorResponseType::InvalidGrant =>
|
||||||
|
{
|
||||||
|
// Refresh failed, refresh_token most likely expired or
|
||||||
|
// invalid, the session can be considered lost
|
||||||
|
login_session.refresh_token = None;
|
||||||
|
}
|
||||||
|
Err(err) => {
|
||||||
|
return Err(err.into());
|
||||||
|
}
|
||||||
|
};
|
||||||
|
|
||||||
let session = parts
|
let session = parts
|
||||||
.extensions
|
.extensions
|
||||||
|
|
Loading…
Reference in a new issue