mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-06 09:13:19 +03:00
🚀 Feature: Provide introspection endpoint #273
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @aksdb on GitHub.
Feature description
In OAuth2 flows, where the server needs to verify the validity of a token provided by a client, it may be of use to offer token introspection as defined in RFC7662 and advertise it as
introspection_endpointin/.well-known/openid-configuration.Pitch
An single-page-application could be a public OIDC app acquiring an access token. This is passed to a backend which has its own OIDC app. That backend can then make use of the introspection endpoint, to verify the validity of the token and extract information from it.
An application that uses it is for example OpenTalk.
@kmendell commented on GitHub:
I added the needs-more-upvotes label for now. I want to research this more as well.
Also @stonith404 please provide your input on this.
@stonith404 commented on GitHub:
Yes, this would make sense to add.
A client should be able to verify the access token by using the JWK from the
.well-known/jwks.jsonendpoint but there are probably clients that use the introspection endpoint instead.