doorkeeper 5.9.5 → 5.9.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d3e4ee342094b7729f29bb64d9045cfd9736d99388c5bb15d68568c6d59a8a54
-  data.tar.gz: e1549e74f00d26b85ed9afedbfaba17adce5a4e8a62c5ee01a8c4ff70c71bbcf
+  metadata.gz: b21e3bb3454e1896aa0a0d022741de322d5cf604de408dfe58a1a4ef2a21cfbc
+  data.tar.gz: 9384048264886cad0506a879964635253fb00a4903a6347e7801c066c6f971d3
 SHA512:
-  metadata.gz: d91e3f678a7a3d53e94c607b5b88d5a6e695e166a52fd9f5527c8988bd717c60debc292798c159da7356966baa4d26ad22d56a9b922582040e758c37ef26ea96
-  data.tar.gz: e335f698b2a3fe29b139e826fafada70b94fd239a0c2e0f2be762075c27bb73c8dab4c93a9581089214b07f9016af893cd0c70daf0fdc2db9c8b72f7ae848850
+  metadata.gz: 18f0100ea947793a51547ee3de5ffd0927b8c4a6e1a9b491448c4149927ec34521b4d28c45056c5ca0d4b6dd87f79b796167e463f0a4cb1830eb2bf5732fc9b8
+  data.tar.gz: 16c2996fa91d47283fcbf491773d7f2ed4d0e14b8faf0566f6757875de1b31af3ac058e19a77487c74ec13ca6dfde6a619048484b73f5a4bccc9814441a24122

data/CHANGELOG.md

@@ -5,16 +5,18 @@ upgrade guides.
 
 User-visible changes worth mentioning.
 
-## main
+## 5.9.7
 
-- Please add here
+- Refuse requests that transmit an access token by more than one method (RFC 6750 §2), instead of silently authorizing with the first configured `access_token_methods` entry that matched and discarding the other tokens. Such a request now fails closed as carrying no usable token (401 `invalid_token`); no calling contract changes. The form-encoded body (§2.2) and the URI query (§2.3) count as two methods even though Rails and Rack merge them into a single `params` hash. The same token repeated across two methods is refused too — §2 forbids the second method, not a disagreement between the two — and a custom callable extractor in `access_token_methods` keeps the historical first-wins behavior and is never invoked more than once. (The strict `invalid_request` (400) answer §3.1 prescribes ships with Doorkeeper 6.0.)
+- [#1925] Internal: pin the development dependency on `json` below 3.0. json 3 removed the positional options Hash from `JSON.parse` and the `quirks_mode` option from `JSON.generate`, both of which Active Support still uses, so the suite could not run on any supported Rails version.
 
-## 5.9.5
+## 5.9.6
 
-- [#1901] Reject requests that authenticate the client with more than one method (RFC 6749 §2.3) with an `invalid_request` error, instead of silently authenticating with the first method that matched and discarding the other credentials.
+- Reject requests that present more than one client identity (e.g. an `Authorization: Basic` header for one client and a `client_id` parameter naming another) with an `invalid_request` error, instead of authenticating the first extracted identity and silently discarding the other one. A `client_id` sent alongside another authentication method keeps working when it identifies the same client (RFC 7521 §4.2). Like the RFC 6749 §2.3 check released in 5.9.5, this validation does not apply when `client_credentials` is configured with a callable extractor, since the credentials the remaining extractors would return are never evaluated — the `client_credentials` option documents that now.
 
-## 5.9.4
+## 5.9.5
 
+- Reject requests that authenticate the client with more than one method (RFC 6749 §2.3) with an `invalid_request` error, instead of silently authenticating with the first method that matched and discarding the other credentials.
 - [#1853] Fix `reuse_access_token` reusing a token that was created with `custom_access_token_attributes` values when the new request doesn't specify any custom attributes. Such requests now only match tokens without custom attributes.
 
 ## 5.9.3
@@ -65,7 +67,6 @@ User-visible changes worth mentioning.
 - [#1779] Only lock previous access token model when creating a new token from its refresh token if revoke_previous_refresh_token_on_use is false
 - [#1778] Ensure that token revocation is idempotent by checking that that token has not already been revoked before revoking.
 
-
 ## 5.8.2
 
 - [#1755] Fix the error message for force_pkce

data/lib/doorkeeper/config.rb

@@ -69,6 +69,10 @@ module Doorkeeper
       # falls back to the `:client_id` and `:client_secret` params from the
       # `params` object.
       #
+      # NOTE: a list that includes a callable extractor opts out of the RFC 6749
+      # §2.3 validation applied to the symbol extractors — see
+      # +Doorkeeper::OAuth::Client::Credentials.from_request+.
+      #
       # @param methods [Array] Define client credentials
       def client_credentials(*methods)
         @config.instance_variable_set(:@client_credentials_methods, methods)

data/lib/doorkeeper/oauth/client/credentials.rb

@@ -10,15 +10,21 @@ module Doorkeeper
           # credentials wins, as it always has.
           #
           # Raises Errors::MultipleClientAuthMethods when the request
-          # authenticates the client with more than one method, which RFC 6749
-          # §2.3 forbids ("The client MUST NOT use more than one authentication
-          # method in each request").
+          # authenticates the client with more than one method, or presents
+          # more than one client identity, which RFC 6749 §2.3 forbids ("The
+          # client MUST NOT use more than one authentication method in each
+          # request").
           def from_request(request, *credentials_methods)
             # Callable extractors are opaque: they may legitimately overlap the
             # built-in methods they are configured with, and evaluating all of
             # them would also break the existing contract that the extractors
             # after the matching one are not called. Such configurations keep
-            # the historical behaviour untouched.
+            # the historical behaviour untouched, including the fact that a
+            # request authenticating with more than one method, or presenting
+            # more than one client identity, resolves to the first extracted
+            # credentials instead of being rejected: the extractor that would
+            # have surfaced the second identity is never evaluated. The
+            # +client_credentials+ configuration option documents this.
             return first_from_request(request, credentials_methods) unless credentials_methods.all?(Symbol)
 
             credentials = credentials_methods.filter_map { |method| extract(request, method) }
@@ -31,6 +37,15 @@ module Doorkeeper
             # method.
             raise Errors::MultipleClientAuthMethods if credentials.count { |c| c.secret.present? } > 1
 
+            # §4.2 allows that bare client_id because it identifies the *same*
+            # client as the authentication method it accompanies. Credentials
+            # naming two different clients are two client identities in one
+            # request and authenticate neither: without this check the first
+            # extracted uid would win and the other identity would be silently
+            # discarded, so the caller could authenticate as one client while
+            # the request asks to act as another.
+            raise Errors::MultipleClientAuthMethods if credentials.uniq(&:uid).size > 1
+
             credentials.first
           end
 

data/lib/doorkeeper/oauth/token.rb

@@ -3,8 +3,54 @@
 module Doorkeeper
   module OAuth
     class Token
+      # Built-in extractors that read a request parameter, and the parameter
+      # each of them reads. RFC 6750 treats the form-encoded body (§2.2) and
+      # the URI query string (§2.3) as two distinct transmission methods, but
+      # Rack and ActionDispatch both collapse them into a single parameter
+      # hash — ActionDispatch lets the query win, Rack lets the body win — so
+      # a request carrying the parameter in both would present a single value
+      # to the extractor and never be refused. The multi-method check reads
+      # the two sources separately for these extractors; selection keeps
+      # using the extractor, so which one wins is unchanged.
+      PARAMETER_EXTRACTORS = {
+        from_access_token_param: "access_token",
+        from_bearer_param: "bearer_token",
+      }.freeze
+
       class << self
+        # RFC 6750 §2: "Clients MUST NOT use more than one method to transmit
+        # the token in each request", and §3.1 lists using more than one method
+        # among the conditions an invalid_request answers. Returning the first
+        # method that yields a value would discard every other token presented
+        # in the same request with no error, warning or log entry, leaving
+        # which token authorizes the request to be decided by the configured
+        # order of +access_token_methods+ rather than by what the caller sent —
+        # so a layer in front of Doorkeeper that reads a different one of them
+        # can reach a different verdict about the very same request.
+        #
+        # What §2 forbids is using more than one method, so the check counts
+        # transmission methods rather than comparing the tokens they carry:
+        # the same value presented twice is still two methods. Refusal answers
+        # nil: the caller is told the request carries no usable token and
+        # fails closed with the invalid_token (401) response, keeping every
+        # calling contract on this stable branch intact — the invalid_request
+        # (400) that §3.1 strictly prescribes needs a new error and render
+        # path, so it ships with 6.0 only.
+        #
+        # Only the built-in extractors — symbols naming methods on this class,
+        # all of them side-effect-free reads of the request — take part in
+        # that check. A custom callable extractor is a configuration adapter
+        # rather than a transmission method: it keeps the historical
+        # first-wins selection and is never invoked more than once, the same
+        # exemption client authentication gives its legacy callable
+        # extractors (Request#validate_client_authentication!).
         def from_request(request, *methods)
+          used = methods.sum do |method|
+            method.is_a?(Symbol) ? transmission_methods_used(request, method) : 0
+          end
+
+          return if used > 1
+
           methods.inject(nil) do |_, method|
             method = self.method(method) if method.is_a?(Symbol)
             credentials = method.call(request)
@@ -44,6 +90,36 @@ module Doorkeeper
 
         private
 
+        # How many transmission methods the given built-in extractor finds a
+        # token in. Usually one, or none — but for the parameter extractors
+        # above it is the body and the query counted separately, since the
+        # parameter hash collapsed them into the single value the extractor
+        # reads. That value is counted on its own only when neither raw source
+        # explains it, so a token reaching the extractor by some other route —
+        # an :access_token path segment, or a host that overrode the extractor
+        # — is still counted exactly once rather than twice.
+        def transmission_methods_used(request, method)
+          value = self.method(method).call(request).presence
+
+          parameter = PARAMETER_EXTRACTORS[method]
+          return value ? 1 : 0 unless parameter
+
+          sources = parameter_sources(request, parameter)
+          sources.size + (value && !sources.include?(value) ? 1 : 0)
+        end
+
+        # The form-encoded body (§2.2) and the URI query (§2.3) as Rack
+        # exposes them, for a request object that keeps the two apart.
+        def parameter_sources(request, parameter)
+          return [] unless request.respond_to?(:GET) && request.respond_to?(:POST)
+
+          query = request.GET
+          body = request.POST
+          return [] unless query.is_a?(Hash) && body.is_a?(Hash)
+
+          [query[parameter], body[parameter]].filter_map(&:presence)
+        end
+
         def token_from_basic_header(header, pattern)
           encoded_header = token_from_header(header, pattern)
           decode_basic_credentials_token(encoded_header)

data/lib/doorkeeper/version.rb

@@ -5,7 +5,7 @@ module Doorkeeper
     # Semantic versioning
     MAJOR = 5
     MINOR = 9
-    TINY = 5
+    TINY = 7
     PRE = nil
 
     # Full version number

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -283,6 +283,14 @@ Doorkeeper.configure do
   # Check out https://github.com/doorkeeper-gem/doorkeeper/wiki/Changing-how-clients-are-authenticated
   # for more information on customization
   #
+  # NOTE: configuring a callable extractor opts the request out of the RFC 6749
+  # §2.3 checks that reject a request authenticating the client with more than
+  # one method, or presenting more than one client identity. A callable may
+  # legitimately overlap the built-in extractors, and the extractors after the
+  # matching one are never called, so what they would have returned is unknown.
+  # Prefer the symbol extractors unless you need something they cannot express;
+  # a callable has to reject such a request itself.
+  #
   # client_credentials :from_basic, :from_params
 
   # Change the way access token is authenticated from the request object.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 5.9.5
+  version: 5.9.7
 platform: ruby
 authors:
 - Felipe Elias Philipp
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-07 00:00:00.000000000 Z
+date: 2026-09-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -261,7 +261,6 @@ files:
 - lib/doorkeeper/oauth/pre_authorization.rb
 - lib/doorkeeper/oauth/refresh_token_request.rb
 - lib/doorkeeper/oauth/scopes.rb
-- lib/doorkeeper/oauth/stateless_token.rb
 - lib/doorkeeper/oauth/token.rb
 - lib/doorkeeper/oauth/token_introspection.rb
 - lib/doorkeeper/oauth/token_request.rb

data/lib/doorkeeper/oauth/stateless_token.rb

@@ -1,139 +0,0 @@
-# frozen_string_literal: true
-
-module Doorkeeper
-  module OAuth
-    # In-memory representation of a verified JWT access token. Returned by
-    # OAuth::Token.authenticate when stateless_jwt_tokens is enabled, so that
-    # the existing doorkeeper_token / doorkeeper_authorize! helpers work
-    # without any database read.
-    #
-    # Stateless tokens cannot be revoked or refreshed server-side: #revoked?
-    # is always false and #revoke is a no-op. Rely on short token lifetimes
-    # (access_token_expires_in) for early invalidation.
-    class StatelessToken
-      attr_reader :claims, :application, :raw_token
-
-      def initialize(claims:, application: nil, raw_token: nil)
-        @claims = claims
-        @application = application
-        @raw_token = raw_token
-      end
-
-      def token_type
-        "Bearer"
-      end
-
-      # The raw token string. Used by introspection's
-      # authorized_token_matches_introspected? security check.
-      def token
-        @raw_token
-      end
-
-      # Issuance path: the freshly-signed JWT returned to the client.
-      def plaintext_token
-        @raw_token
-      end
-
-      def plaintext_refresh_token
-        nil
-      end
-
-      def resource_owner_id
-        claims["resource_owner_id"] || claims["sub"]
-      end
-
-      def application_id
-        application&.id
-      end
-
-      def scopes_string
-        claims["scope"].to_s
-      end
-
-      def scopes
-        OAuth::Scopes.from_string(scopes_string)
-      end
-
-      def includes_scope?(*required_scopes)
-        required_scopes.blank? || required_scopes.any? { |scope| scopes.exists?(scope.to_s) }
-      end
-
-      def custom_attributes
-        claims.slice(*Doorkeeper.config.custom_access_token_attributes.map(&:to_s))
-      end
-
-      # RFC 8707 resource indicator. Stored as a space-delimited string to
-      # match the AccessToken column shape consumed by token_introspection.
-      def resource
-        aud = claims["aud"]
-        return nil if aud.blank?
-
-        aud.is_a?(Array) ? aud.join(" ") : aud.to_s
-      end
-
-      def created_at
-        Time.at(claims["iat"].to_i).utc
-      end
-
-      def expires_in
-        claims["expires_in"]
-      end
-
-      def expires_at
-        return nil unless claims["exp"]
-
-        Time.at(claims["exp"].to_i).utc
-      end
-
-      def expires_in_seconds
-        return nil unless expires_at
-
-        expires = expires_at - Time.now.utc
-        sec = expires.seconds.round(0)
-        sec > 0 ? sec : 0
-      end
-
-      def expired?
-        return false unless expires_at
-
-        Time.now.utc > expires_at
-      end
-
-      def revoked?
-        false
-      end
-
-      def accessible?
-        !expired? && !revoked?
-      end
-
-      def acceptable?(required_scopes)
-        accessible? && includes_scope?(*required_scopes)
-      end
-
-      def revoke_previous_refresh_token!
-        # no-op: stateless tokens carry no refresh-token chain to revoke.
-      end
-
-      def revoke
-        # no-op: stateless tokens cannot be revoked server-side.
-      end
-
-      def revocable?
-        false
-      end
-
-      def as_json(_options = {})
-        {
-          resource_owner_id: resource_owner_id,
-          scope: scopes,
-          expires_in: expires_in_seconds,
-          application: { uid: application.try(:uid) },
-          created_at: created_at.to_i,
-        }.tap do |json|
-          json[:resource_owner_type] = claims["resource_owner_type"] if Doorkeeper.configuration.polymorphic_resource_owner?
-        end
-      end
-    end
-  end
-end