Raise InvalidGrantError if no associated grant exists when invalidating an authorization code #1476
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Previously, when invalidating an authorization code after it has been used, if for whatever reason the associated grant object no longer exists, an uncaught exception would be raised - Grant.DoesNotExist. This could be caused by concurrent requests being made using the same authorization token. We now handle this scenario gracefully by catching Grant.DoesNotExist and returning an InvalidGrantError.
mforner13
force-pushed
the
raise-invalid-grant-error-invalidate-auth-code
branch
from
3316ac5
to
7becf1c
Compare
n2ygk
approved these changes
Sep 3, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of the Change
This change raises an
InvalidGrantErrorfrom theOAuth2Validator.invalidate_authorization_codemethod if the Grant object intended to be deleted does not exist.Currently, when invalidating an authorization code after it has been used, if for whatever reason the associated grant object no longer exists, an uncaught
Grant.DoesNotExistexception is raised. This leads to 500 responses being returned to clients. This could, for example, be caused by concurrent requests being made using the same authorization code.The change in this PR handles this scenario gracefully by catching
Grant.DoesNotExistand raising anInvalidGrantErrorwhich will return a 400 'invalid_grant' response to the client.Checklist
CHANGELOG.mdupdated (only for user relevant changes)AUTHORS