-
Notifications
You must be signed in to change notification settings - Fork 2.7k
AT Proof-Of-Possession #2: Handle proof-of-possession tokens correctly in responses #2153
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overall looks good. Just a couple more places to update references to id tokens. Also please take a look at the comments and update where necessary as there are lots that would be left outdated with these changes.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good. Would be good to have some tests.
@@ -34,12 +34,10 @@ export class RefreshTokenClient extends BaseClient { | |||
); | |||
|
|||
responseHandler.validateTokenResponse(response.body); | |||
const tokenResponse = responseHandler.handleServerTokenResponse( | |||
return await responseHandler.handleServerTokenResponse( |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should this also pass in request.resourceRequestMethod
and request.resourceRequestUri
given that they were added to RefreshTokenRequest
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've handled this in a later PR, this PR only covers the authorization code 2 legged flow, not the refresh flow.
This PR is a follow up to PR #2151, and implements the response handling part of the proof-of-possession flow in msal-common.
This PR specifically adds the following: