If an authorization code is detected as reused, the token endpoint rejects the request and revoke existing access tokens [0]. Test scenario: 1. In the project admin create an OAuth2 app (note the ID and the given secret) 2. Access the authorize page at the URL https://tuleap.example.com/oauth2/authorize?client_id=<client_d>&scope=demo&response_type=code&redirect_uri=<redirect_uri> 3. Quickly retrieve (it is valid only 1 minute) the authorization code from the URL 4. Exchange the authorization code for an access token: shell> curl -X POST -H 'Content-Type: application/x-www-form-urlencoded' \ --user '<client_id>:<client_secret>' \ --data 'grant_type=authorization_code&redirect_uri=<redirect_uri>&code=<authorization_code>' \ https://tuleap.example.com/oauth2/token 5. Try to replay the same request. No access token should be delivered and the previous one should be revoked. This is part of story #14542: have OAuth2 flow [0] https://tools.ietf.org/html/rfc6749#section-4.1.2 Change-Id: I5f74186d21319b2d28e946cb9a94803bacd98d01

+140 −0

Author

Thomas Gerbet (tgerbet) 2020-03-12 15:45

Committer

Thomas Gerbet (tgerbet) 2020-03-13 10:53

Hash e3d3dd4cdf54383217664d642d4004220f51da51

Parent 9089ca5893248f81fd7b28536038a5f6eb3d10b1

Reference git #tuleap/stable/e3d3dd4cdf54383217664d642d4004220f51da51