ory / fosite / 1518

71%

push

travis-ci

fix: do not issue refresh tokens to clients who cannot use it (#430)

No prior discussion, but this is somewhat related to #370, which makes it possible for clients to be issued a refresh token without requesting a scope.

There may be clients which may not be allowed to use the refresh_token grant type, but which will currently be issued a refresh token during the authorization code flow. Disallowing the refresh_token grant type might be particularly common when there are public clients (using this flow with PKCE).

It is impossible to use the issued refresh token when the client does not have the grant type, and no other client can use it either. It would be neater to avoid issuing refresh tokens that cannot be used.

10 of 10 new or added lines in 1 file covered. (100.0%)

3841 of 5376 relevant lines covered (71.45%)

71.41 hits per line