DLMousey / DLMousey/OIDC.Core

Client credentials user creation spam

Open
#1 0 comments 0 reactions 0 assignees View on GitHub
bug invalid
Dominant language
C#
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

Slight problem in the OAuth controller on [lines 394-399](https://github.com/DLMousey/OIDC.Core-Redux/blob/2dd1ed858d7c0dfdae100672043c81a802dbb4d1/OIDC.Core-Minimal/Controllers/OAuthController.cs#L392-L399) - every time a client credentials grant is used a new user will be created. This isn't ideal since if this is used heavily it'll result in a _lot_ of ephemeral users being created.

Change this to a find or create type method based off the client id, the password is already a random value so there's minimal danger of it being brute forced. Ideally these user accounts should have some kind of `NoLogin` flag set that prevents them being used outside of the oauth flow entirely.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.