zitadel/internal/api
Tim Möhlmann 778b4041ca
fix(oidc): do not return access token for response type id_token (#8777)
# Which Problems Are Solved

Do not return an access token for implicit flow from v1 login, if the
`response_type` is `id_token`

# How the Problems Are Solved

Do not create the access token event if if the `response_type` is
`id_token`.

# Additional Changes

Token endpoint calls without auth request, such as machine users, token
exchange and refresh token, do not have a `response_type`. For such
calls the `OIDCResponseTypeUnspecified` enum is added at a `-1` offset,
in order not to break existing client configs.

# Additional Context

- https://discord.com/channels/927474939156643850/1294001717725237298
- Fixes https://github.com/zitadel/zitadel/issues/8776
2024-11-12 15:20:48 +00:00
..
assets feat: trusted (instance) domains (#8369) 2024-07-31 18:00:38 +03:00
authz perf(milestones): refactor (#8788) 2024-10-28 08:29:34 +00:00
call fix: reset the call timestamp after a bulk trigger (#6080) 2023-07-07 08:15:05 +00:00
grpc fix: fix slice init length (#8707) 2024-11-12 14:41:18 +00:00
http feat(oidc): use web keys for token signing and verification (#8449) 2024-08-23 14:43:46 +02:00
idp chore: improve integration tests (#8727) 2024-10-17 21:20:57 +00:00
info fix: correct method and path for session api activity (#6880) 2023-11-22 12:12:23 +02:00
oidc fix(oidc): do not return access token for response type id_token (#8777) 2024-11-12 15:20:48 +00:00
robots_txt fix: introduce measures to avoid bots crawling and indexing activities (#5728) 2023-05-05 10:25:02 +02:00
saml fix(eventstore): revert precise decimal (#8527) (#8679) 2024-09-24 18:43:29 +02:00
service fix(eventstore): tests 2020-11-26 09:19:14 +01:00
ui fix(login): org register script references (#8842) 2024-10-31 10:16:30 +00:00
api.go feat: trusted (instance) domains (#8369) 2024-07-31 18:00:38 +03:00