[PR #405] feat: implement token introspection #823

New Issue

OVERLORD · 2025-10-07T00:22:59+03:00

OVERLORD commented

2025-10-07 00:22:59 +03:00

Original Pull Request: https://github.com/pocket-id/pocket-id/pull/405

State: closed
Merged: Yes

This PR implements the token introspection as requested in ticket #395.

It fulfills RFC 7662 as far as I can tell (at least the client that required it is happy with the result).

The endpoint requires a client_id/client_secret pair for authentication, so no random attackers can use it to fish for valid tokens (although that attack vector is pretty limited currently, since we don't offer any token revocation anyway). Potentially we could also allow API token auth for this endpoint, but for now it should be a good start with clientid/clientsecret already.

It also allows checking for the validity of a refresh_token.

Fixes: https://github.com/pocket-id/pocket-id/issues/395

**Original Pull Request:** https://github.com/pocket-id/pocket-id/pull/405 **State:** closed **Merged:** Yes --- This PR implements the token introspection as requested in ticket #395. It fulfills RFC 7662 as far as I can tell (at least the client that required it is happy with the result). The endpoint requires a `client_id`/`client_secret` pair for authentication, so no random attackers can use it to fish for valid tokens (although that attack vector is pretty limited currently, since we don't offer any token revocation anyway). Potentially we could also allow API token auth for this endpoint, but for now it should be a good start with clientid/clientsecret already. It also allows checking for the validity of a `refresh_token`. Fixes: https://github.com/pocket-id/pocket-id/issues/395

OVERLORD added the pull-request label 2025-10-07 00:22:59 +03:00

OVERLORD closed this issue

2025-10-07 00:23:00 +03:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/pocket-id#823