Skip to content

Conversation

@kromacie
Copy link

@kromacie kromacie commented Dec 11, 2021

Hello,

There is a PR started by Steve Porter related to RFC 7662 that wasn't updated for almost three years already. Based on the activity under the old thread and my personal willingness to use it, I think that there is still a demand for this feature. Therefore I decided to refurbish it a bit and refactor it slightly.

There is what I changed compared to the previous PR.

  • I added authorization to use introspection, which should prevent tokens fishing. It's reused from ResourceServerMiddleware, which means, without a valid access token, you can't access the introspection endpoint.
  • I separated introspection from Authorization Server to a dedicated Introspection Server because previously, it introduced many unrelated changes to existing logic. Also, I thought it would be better to keep it apart from Resource Server because it can be and often have to be separated in practice. For the compromise, I decided to put it somewhere in between.

Also, It's my very first contribution to an open-source project, so please feel free to mention any mistake or gap that I didn't find. I hope you will find it helpful.

fetzi and others added 30 commits March 2, 2018 22:53
according to RFC 7662 the introspection mechanism is implemented
…feature/add-introspection-implementation-code-review

# Conflicts:
#	src/Grant/AuthCodeGrant.php
The JWT logic has been moved from the introspection response and is now in the child class BearerTokenIntrospectionResponse
@hafezdivandari
Copy link
Contributor

#1473

@Sephster
Copy link
Member

My apologies this was never progressed and thank you for your efforts. I think this has inspired the implementation in #1473 which is close to being merged. I'm going to close this in favour of that implementation but thank you very much for your efforts here

@Sephster Sephster closed this Nov 25, 2025
@kromacie
Copy link
Author

@Sephster , all good, inspiring anyone is more that I could expect in that case. Good luck guys :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants