doorkeeper 5.9.6 → 5.9.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 233efb73ba5d84b316e665251df23989888d403dd553cd34375891645c00eb14
-  data.tar.gz: eac0e2ca7376e065d96d43c81cafc54931f77386f2b8b2c00d1a69f7ca0f4b93
+  metadata.gz: b21e3bb3454e1896aa0a0d022741de322d5cf604de408dfe58a1a4ef2a21cfbc
+  data.tar.gz: 9384048264886cad0506a879964635253fb00a4903a6347e7801c066c6f971d3
 SHA512:
-  metadata.gz: 57c525e75aee988ee335c12415b6d0cea2490890a4ae83dbccc5a9e4b16d6589792aa9c9032ccfb38dd63a30cf9d8080ec87913afe31d577cf07baa7ef916497
-  data.tar.gz: 6dd5a81b7fab1497885c73b601459ab6a12245dff817a17fbba3d40c39bf38a45571ef8526a09a3800baeeabd7e148ceefd412d970b5bff19df8d59374b56d74
+  metadata.gz: 18f0100ea947793a51547ee3de5ffd0927b8c4a6e1a9b491448c4149927ec34521b4d28c45056c5ca0d4b6dd87f79b796167e463f0a4cb1830eb2bf5732fc9b8
+  data.tar.gz: 16c2996fa91d47283fcbf491773d7f2ed4d0e14b8faf0566f6757875de1b31af3ac058e19a77487c74ec13ca6dfde6a619048484b73f5a4bccc9814441a24122

data/CHANGELOG.md

@@ -5,6 +5,11 @@ upgrade guides.
 
 User-visible changes worth mentioning.
 
+## 5.9.7
+
+- Refuse requests that transmit an access token by more than one method (RFC 6750 §2), instead of silently authorizing with the first configured `access_token_methods` entry that matched and discarding the other tokens. Such a request now fails closed as carrying no usable token (401 `invalid_token`); no calling contract changes. The form-encoded body (§2.2) and the URI query (§2.3) count as two methods even though Rails and Rack merge them into a single `params` hash. The same token repeated across two methods is refused too — §2 forbids the second method, not a disagreement between the two — and a custom callable extractor in `access_token_methods` keeps the historical first-wins behavior and is never invoked more than once. (The strict `invalid_request` (400) answer §3.1 prescribes ships with Doorkeeper 6.0.)
+- [#1925] Internal: pin the development dependency on `json` below 3.0. json 3 removed the positional options Hash from `JSON.parse` and the `quirks_mode` option from `JSON.generate`, both of which Active Support still uses, so the suite could not run on any supported Rails version.
+
 ## 5.9.6
 
 - Reject requests that present more than one client identity (e.g. an `Authorization: Basic` header for one client and a `client_id` parameter naming another) with an `invalid_request` error, instead of authenticating the first extracted identity and silently discarding the other one. A `client_id` sent alongside another authentication method keeps working when it identifies the same client (RFC 7521 §4.2). Like the RFC 6749 §2.3 check released in 5.9.5, this validation does not apply when `client_credentials` is configured with a callable extractor, since the credentials the remaining extractors would return are never evaluated — the `client_credentials` option documents that now.
@@ -62,7 +67,6 @@ User-visible changes worth mentioning.
 - [#1779] Only lock previous access token model when creating a new token from its refresh token if revoke_previous_refresh_token_on_use is false
 - [#1778] Ensure that token revocation is idempotent by checking that that token has not already been revoked before revoking.
 
-
 ## 5.8.2
 
 - [#1755] Fix the error message for force_pkce

data/lib/doorkeeper/oauth/token.rb

@@ -3,8 +3,54 @@
 module Doorkeeper
   module OAuth
     class Token
+      # Built-in extractors that read a request parameter, and the parameter
+      # each of them reads. RFC 6750 treats the form-encoded body (§2.2) and
+      # the URI query string (§2.3) as two distinct transmission methods, but
+      # Rack and ActionDispatch both collapse them into a single parameter
+      # hash — ActionDispatch lets the query win, Rack lets the body win — so
+      # a request carrying the parameter in both would present a single value
+      # to the extractor and never be refused. The multi-method check reads
+      # the two sources separately for these extractors; selection keeps
+      # using the extractor, so which one wins is unchanged.
+      PARAMETER_EXTRACTORS = {
+        from_access_token_param: "access_token",
+        from_bearer_param: "bearer_token",
+      }.freeze
+
       class << self
+        # RFC 6750 §2: "Clients MUST NOT use more than one method to transmit
+        # the token in each request", and §3.1 lists using more than one method
+        # among the conditions an invalid_request answers. Returning the first
+        # method that yields a value would discard every other token presented
+        # in the same request with no error, warning or log entry, leaving
+        # which token authorizes the request to be decided by the configured
+        # order of +access_token_methods+ rather than by what the caller sent —
+        # so a layer in front of Doorkeeper that reads a different one of them
+        # can reach a different verdict about the very same request.
+        #
+        # What §2 forbids is using more than one method, so the check counts
+        # transmission methods rather than comparing the tokens they carry:
+        # the same value presented twice is still two methods. Refusal answers
+        # nil: the caller is told the request carries no usable token and
+        # fails closed with the invalid_token (401) response, keeping every
+        # calling contract on this stable branch intact — the invalid_request
+        # (400) that §3.1 strictly prescribes needs a new error and render
+        # path, so it ships with 6.0 only.
+        #
+        # Only the built-in extractors — symbols naming methods on this class,
+        # all of them side-effect-free reads of the request — take part in
+        # that check. A custom callable extractor is a configuration adapter
+        # rather than a transmission method: it keeps the historical
+        # first-wins selection and is never invoked more than once, the same
+        # exemption client authentication gives its legacy callable
+        # extractors (Request#validate_client_authentication!).
         def from_request(request, *methods)
+          used = methods.sum do |method|
+            method.is_a?(Symbol) ? transmission_methods_used(request, method) : 0
+          end
+
+          return if used > 1
+
           methods.inject(nil) do |_, method|
             method = self.method(method) if method.is_a?(Symbol)
             credentials = method.call(request)
@@ -44,6 +90,36 @@ module Doorkeeper
 
         private
 
+        # How many transmission methods the given built-in extractor finds a
+        # token in. Usually one, or none — but for the parameter extractors
+        # above it is the body and the query counted separately, since the
+        # parameter hash collapsed them into the single value the extractor
+        # reads. That value is counted on its own only when neither raw source
+        # explains it, so a token reaching the extractor by some other route —
+        # an :access_token path segment, or a host that overrode the extractor
+        # — is still counted exactly once rather than twice.
+        def transmission_methods_used(request, method)
+          value = self.method(method).call(request).presence
+
+          parameter = PARAMETER_EXTRACTORS[method]
+          return value ? 1 : 0 unless parameter
+
+          sources = parameter_sources(request, parameter)
+          sources.size + (value && !sources.include?(value) ? 1 : 0)
+        end
+
+        # The form-encoded body (§2.2) and the URI query (§2.3) as Rack
+        # exposes them, for a request object that keeps the two apart.
+        def parameter_sources(request, parameter)
+          return [] unless request.respond_to?(:GET) && request.respond_to?(:POST)
+
+          query = request.GET
+          body = request.POST
+          return [] unless query.is_a?(Hash) && body.is_a?(Hash)
+
+          [query[parameter], body[parameter]].filter_map(&:presence)
+        end
+
         def token_from_basic_header(header, pattern)
           encoded_header = token_from_header(header, pattern)
           decode_basic_credentials_token(encoded_header)

data/lib/doorkeeper/version.rb

@@ -5,7 +5,7 @@ module Doorkeeper
     # Semantic versioning
     MAJOR = 5
     MINOR = 9
-    TINY = 6
+    TINY = 7
     PRE = nil
 
     # Full version number

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 5.9.6
+  version: 5.9.7
 platform: ruby
 authors:
 - Felipe Elias Philipp
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-11 00:00:00.000000000 Z
+date: 2026-09-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties