From 03cab69d6bf50bbaf0d0255373b3c8362547bce0 Mon Sep 17 00:00:00 2001 From: Elias Schneider Date: Tue, 13 Oct 2026 22:34:41 +0200 Subject: [PATCH] refactor: remove unused issuer check from refresh token API validation --- backend/internal/oidc/token_handler.go | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/backend/internal/oidc/token_handler.go b/backend/internal/oidc/token_handler.go index de4d297b..79709661 100644 --- a/backend/internal/oidc/token_handler.go +++ b/backend/internal/oidc/token_handler.go @@ -117,12 +117,7 @@ func (h *tokenHandler) validateRefreshAPIGrant(ctx context.Context, client Clien return nil } - issuer := "" - if h.claimsService != nil { - issuer = h.claimsService.baseURL - } - - resource, err := refreshGrantResource(client.GetID(), issuer, accessRequest.GetGrantedAudience()) + resource, err := refreshGrantResource(client.GetID(), accessRequest.GetGrantedAudience()) if err != nil { return err } @@ -131,10 +126,11 @@ func (h *tokenHandler) validateRefreshAPIGrant(ctx context.Context, client Clien return err } -func refreshGrantResource(clientID, issuer string, grantedAudience fosite.Arguments) (string, error) { +// refreshGrantResource recovers the API resource of a refresh grant from its granted audience +func refreshGrantResource(clientID string, grantedAudience fosite.Arguments) (string, error) { resource := "" for _, audience := range grantedAudience { - if audience == "" || audience == clientID || audience == issuer { + if audience == "" || audience == clientID { continue } if resource != "" && resource != audience {