cloudfoundry / cloudfoundry/uaa
introspect endpoint don't follow rfc7662
@strehle is already working on this.
Since Nov 18, 2022.
- Dominant language
- Java
- Stars
- 1.6k
- Forks
- 844
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 27
Description
SECURITY NOTICE: If you have found a security problem in the UAA, please do not file a public github issue. Instead, please send an email to security@cloudfoundry.org
Thanks for taking the time to file an issue. You'll minimize back and forth and help us help you more effectively by answering all of the following questions as specifically and completely as you can.
What version of UAA are you running?
http://docs.cloudfoundry.org/api/uaa/version/74.15.0
What did you do?
Hit /introspect endpoint to fetch the scope.
What did you expect to see? What goal are you trying to achieve with the UAA?
According to RFC, the SCOPE should be a JSON String containing a space-separated list of scopes associated with the token. And this is how all the frameworks like Spring Security etc. and most of the major programming languages has built by following RFC.
"scope" : "scim.userids openid cloud_controller.read password.write cloud_controller.write
What did you see instead?
I get the scope as an array like below:
"scope" : [ "scim.userids", "openid", "cloud_controller.read", "password.write", "cloud_controller.write" ]
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.