Client credentials user creation spam
- Dominant language
- C#
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
Slight problem in the OAuth controller on [lines 394-399](https://github.com/DLMousey/OIDC.Core-Redux/blob/2dd1ed858d7c0dfdae100672043c81a802dbb4d1/OIDC.Core-Minimal/Controllers/OAuthController.cs#L392-L399) - every time a client credentials grant is used a new user will be created. This isn't ideal since if this is used heavily it'll result in a _lot_ of ephemeral users being created.
Change this to a find or create type method based off the client id, the password is already a random value so there's minimal danger of it being brute forced. Ideally these user accounts should have some kind of `NoLogin` flag set that prevents them being used outside of the oauth flow entirely.
Contributor guide
Assessment
This issue has not been assessed yet.