doorkeeper 5.9.3 → 5.9.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71a32b8766b44f5eff16fbc128cfff6ab676b5af9104d16d58f060a0ed6d894c
-  data.tar.gz: 864e07764f1ba86d6f52a10e5a081291c2748dcecbfb8bcc60b0f27baa4e616e
+  metadata.gz: 233efb73ba5d84b316e665251df23989888d403dd553cd34375891645c00eb14
+  data.tar.gz: eac0e2ca7376e065d96d43c81cafc54931f77386f2b8b2c00d1a69f7ca0f4b93
 SHA512:
-  metadata.gz: 4116cfa7e4e06a1bff79489ddeced66af1803dedd6f2e1b1b5edd67db0d90e444922a87cfc2215a4e61357e54ddf988606c3ecce40e50afb24fdd5e06808a2bd
-  data.tar.gz: 558ec2ac88215ba2cde034380a27d44d0c989841942c070e4ea02a746d154944b094ae2aa6a9284c7cca6d310705634fde4f6566fbf8a268a0c1b33e41937107
+  metadata.gz: 57c525e75aee988ee335c12415b6d0cea2490890a4ae83dbccc5a9e4b16d6589792aa9c9032ccfb38dd63a30cf9d8080ec87913afe31d577cf07baa7ef916497
+  data.tar.gz: 6dd5a81b7fab1497885c73b601459ab6a12245dff817a17fbba3d40c39bf38a45571ef8526a09a3800baeeabd7e148ceefd412d970b5bff19df8d59374b56d74

data/CHANGELOG.md

@@ -5,9 +5,14 @@ upgrade guides.
 
 User-visible changes worth mentioning.
 
-## main
+## 5.9.6
 
-- Please add here
+- Reject requests that present more than one client identity (e.g. an `Authorization: Basic` header for one client and a `client_id` parameter naming another) with an `invalid_request` error, instead of authenticating the first extracted identity and silently discarding the other one. A `client_id` sent alongside another authentication method keeps working when it identifies the same client (RFC 7521 §4.2). Like the RFC 6749 §2.3 check released in 5.9.5, this validation does not apply when `client_credentials` is configured with a callable extractor, since the credentials the remaining extractors would return are never evaluated — the `client_credentials` option documents that now.
+
+## 5.9.5
+
+- Reject requests that authenticate the client with more than one method (RFC 6749 §2.3) with an `invalid_request` error, instead of silently authenticating with the first method that matched and discarding the other credentials.
+- [#1853] Fix `reuse_access_token` reusing a token that was created with `custom_access_token_attributes` values when the new request doesn't specify any custom attributes. Such requests now only match tokens without custom attributes.
 
 ## 5.9.3
 

data/config/locales/en.yml

@@ -97,6 +97,7 @@ en:
           missing_param: 'Missing required parameter: %{value}.'
           request_not_authorized: 'Request needs to be authorized. Required parameter for authorizing the request is missing or invalid.'
           invalid_code_challenge: 'Code challenge is required.'
+          multiple_client_auth_methods: 'The request utilizes more than one mechanism for authenticating the client.'
         invalid_redirect_uri: "The requested redirect URI is malformed or doesn't match the client redirect URI."
         unauthorized_client: 'The client is not authorized to perform this request using this method.'
         access_denied: 'The resource owner or authorization server denied the request.'

data/lib/doorkeeper/config.rb

@@ -69,6 +69,10 @@ module Doorkeeper
       # falls back to the `:client_id` and `:client_secret` params from the
       # `params` object.
       #
+      # NOTE: a list that includes a callable extractor opts out of the RFC 6749
+      # §2.3 validation applied to the symbol extractors — see
+      # +Doorkeeper::OAuth::Client::Credentials.from_request+.
+      #
       # @param methods [Array] Define client credentials
       def client_credentials(*methods)
         @config.instance_variable_set(:@client_credentials_methods, methods)

data/lib/doorkeeper/errors.rb

@@ -24,6 +24,19 @@ module Doorkeeper
       end
     end
 
+    # Raised when a request uses more than one client authentication method,
+    # which RFC 6749 §2.3 explicitly forbids ("The client MUST NOT use more
+    # than one authentication method in each request").
+    class MultipleClientAuthMethods < DoorkeeperError
+      def type
+        :invalid_request
+      end
+
+      def reason
+        :multiple_client_auth_methods
+      end
+    end
+
     class MissingRequiredParameter < DoorkeeperError
       attr_reader :missing_param
 

data/lib/doorkeeper/helpers/controller.rb

@@ -56,7 +56,8 @@ module Doorkeeper
           OAuth::InvalidRequestResponse.new(
             name: exception.type,
             state: params[:state],
-            missing_param: exception.missing_param,
+            missing_param: exception.try(:missing_param),
+            reason: exception.try(:reason),
           )
         else
           OAuth::ErrorResponse.new(name: exception.type, state: params[:state])

data/lib/doorkeeper/models/access_token_mixin.rb

@@ -89,7 +89,8 @@ module Doorkeeper
       # @param custom_attributes [Nilable Hash]
       #   A nil value, or hash with keys corresponding to the custom attributes
       #   configured with the `custom_access_token_attributes` config option.
-      #   A nil value will ignore custom attributes.
+      #   A nil value will ignore custom attributes, while an empty hash will
+      #   only match tokens that have no custom attributes set.
       #
       # @return [Doorkeeper::AccessToken, nil] Access Token instance or
       #   nil if matching record was not found
@@ -124,7 +125,8 @@ module Doorkeeper
       # @param custom_attributes [Nilable Hash]
       #   A nil value, or hash with keys corresponding to the custom attributes
       #   configured with the `custom_access_token_attributes` config option.
-      #   A nil value will ignore custom attributes.
+      #   A nil value will ignore custom attributes, while an empty hash will
+      #   only match tokens that have no custom attributes set.
       #
       # @return [Doorkeeper::AccessToken, nil] Access Token instance or
       #   nil if matching record was not found
@@ -220,7 +222,10 @@ module Doorkeeper
         scopes = Doorkeeper::OAuth::Scopes.from_string(scopes) if scopes.is_a?(String)
 
         if Doorkeeper.config.reuse_access_token
-          custom_attributes = extract_custom_attributes(token_attributes).presence
+          # An empty hash must stay distinct from nil here: nil ignores custom
+          # attributes when matching, while an empty hash only matches tokens
+          # that have no custom attributes set.
+          custom_attributes = extract_custom_attributes(token_attributes)
           access_token = matching_token_for(
             application, resource_owner, scopes, custom_attributes: custom_attributes, include_expired: false,
           )

data/lib/doorkeeper/oauth/client/credentials.rb

@@ -5,12 +5,48 @@ module Doorkeeper
     class Client
       Credentials = Struct.new(:uid, :secret) do
         class << self
+          # Extracts the client credentials from the request using the
+          # configured extraction methods. The first method that yields
+          # credentials wins, as it always has.
+          #
+          # Raises Errors::MultipleClientAuthMethods when the request
+          # authenticates the client with more than one method, or presents
+          # more than one client identity, which RFC 6749 §2.3 forbids ("The
+          # client MUST NOT use more than one authentication method in each
+          # request").
           def from_request(request, *credentials_methods)
-            credentials_methods.inject(nil) do |_, method|
-              method = self.method(method) if method.is_a?(Symbol)
-              credentials = Credentials.new(*method.call(request))
-              break credentials if credentials.present?
-            end
+            # Callable extractors are opaque: they may legitimately overlap the
+            # built-in methods they are configured with, and evaluating all of
+            # them would also break the existing contract that the extractors
+            # after the matching one are not called. Such configurations keep
+            # the historical behaviour untouched, including the fact that a
+            # request authenticating with more than one method, or presenting
+            # more than one client identity, resolves to the first extracted
+            # credentials instead of being rejected: the extractor that would
+            # have surfaced the second identity is never evaluated. The
+            # +client_credentials+ configuration option documents this.
+            return first_from_request(request, credentials_methods) unless credentials_methods.all?(Symbol)
+
+            credentials = credentials_methods.filter_map { |method| extract(request, method) }
+
+            # Only credentials carrying a secret authenticate the client. A bare
+            # uid is a public client identifying itself (RFC 6749 §2.3 "none"),
+            # not an authentication method of its own, so it doesn't count
+            # towards the single-method rule — RFC 7521 §4.2, for example,
+            # explicitly allows a client_id next to another authentication
+            # method.
+            raise Errors::MultipleClientAuthMethods if credentials.count { |c| c.secret.present? } > 1
+
+            # §4.2 allows that bare client_id because it identifies the *same*
+            # client as the authentication method it accompanies. Credentials
+            # naming two different clients are two client identities in one
+            # request and authenticate neither: without this check the first
+            # extracted uid would win and the other identity would be silently
+            # discarded, so the caller could authenticate as one client while
+            # the request asks to act as another.
+            raise Errors::MultipleClientAuthMethods if credentials.uniq(&:uid).size > 1
+
+            credentials.first
           end
 
           def from_params(request)
@@ -23,6 +59,22 @@ module Doorkeeper
               Base64.decode64(Regexp.last_match(1)).split(/:/, 2)
             end
           end
+
+          private
+
+          def first_from_request(request, credentials_methods)
+            credentials_methods.inject(nil) do |_, method|
+              credentials = extract(request, method)
+              break credentials if credentials
+            end
+          end
+
+          # Returns the credentials the given method extracts from the request,
+          # or nil when it extracts none.
+          def extract(request, method)
+            method = self.method(method) if method.is_a?(Symbol)
+            Credentials.new(*method.call(request)).presence
+          end
         end
 
         # Public clients may have their secret blank, but "credentials" are

data/lib/doorkeeper/oauth/client_credentials/creator.rb

@@ -45,8 +45,11 @@ module Doorkeeper
         end
 
         def find_active_existing_token_for(client, scopes, attributes)
+          # An empty hash must stay distinct from nil here: nil ignores custom
+          # attributes when matching, while an empty hash only matches tokens
+          # that have no custom attributes set.
           custom_attributes = Doorkeeper.config.access_token_model
-            .extract_custom_attributes(attributes).presence
+            .extract_custom_attributes(attributes)
           Doorkeeper.config.access_token_model.matching_token_for(
             client, nil, scopes, custom_attributes: custom_attributes, include_expired: false,
           )

data/lib/doorkeeper/version.rb

@@ -5,7 +5,7 @@ module Doorkeeper
     # Semantic versioning
     MAJOR = 5
     MINOR = 9
-    TINY = 3
+    TINY = 6
     PRE = nil
 
     # Full version number

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -283,6 +283,14 @@ Doorkeeper.configure do
   # Check out https://github.com/doorkeeper-gem/doorkeeper/wiki/Changing-how-clients-are-authenticated
   # for more information on customization
   #
+  # NOTE: configuring a callable extractor opts the request out of the RFC 6749
+  # §2.3 checks that reject a request authenticating the client with more than
+  # one method, or presenting more than one client identity. A callable may
+  # legitimately overlap the built-in extractors, and the extractors after the
+  # matching one are never called, so what they would have returned is unknown.
+  # Prefer the symbol extractors unless you need something they cannot express;
+  # a callable has to reject such a request itself.
+  #
   # client_credentials :from_basic, :from_params
 
   # Change the way access token is authenticated from the request object.

metadata

@@ -1,16 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 5.9.3
+  version: 5.9.6
 platform: ruby
 authors:
 - Felipe Elias Philipp
 - Tute Costa
 - Jon Moss
 - Nikita Bulai
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-08-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -329,6 +330,7 @@ metadata:
   bug_tracker_uri: https://github.com/doorkeeper-gem/doorkeeper/issues
   documentation_uri: https://doorkeeper.gitbook.io/guides/
   funding_uri: https://opencollective.com/doorkeeper-gem
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -343,7 +345,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.11
+rubygems_version: 3.5.16
+signing_key: 
 specification_version: 4
 summary: OAuth 2 provider for Rails and Grape
 test_files: []