supabase / auth / 41681861952

72%

push

github

fix: restrict OAuth client access tokens to OAuth endpoints (#2898)

## What

Access tokens issued by the OAuth 2.1 server (sessions with
`oauth_client_id` set) are now only accepted on endpoints intended for
OAuth clients. Today that's only `GET /oauth/userinfo`.

- `requireAuthentication` rejects OAuth client tokens with `403
no_authorization`. Every route that uses it is covered by default,
including new routes added later.
- New `requireAuthenticationAllowOAuthClient` is the explicit opt-in,
used only by `/oauth/userinfo`.
- `requireAdminCredentials` also rejects OAuth client tokens. This
covers `/admin/*`, `/invite` and the admin captcha bypass, even if the
user's role is in `JWT.AdminRoles`.
- The check uses `session.oauth_client_id` from the DB rather than the
`client_id` claim, because a custom access token hook can rewrite
claims.

## Behavior change

This only affects access tokens issued to OAuth clients. Regular user
sessions are unchanged.

OAuth client access tokens were previously accepted on the end-user
account endpoints. They now get `403 no_authorization` on:

- `GET /user` and `PUT /user`
- `/factors/*`
- `/passkeys/*`
- `/user/identities/*`
- `/user/oauth/grants`
- `/oauth/authorizations/*`
- `/reauthenticate`
- `/logout`
- `/admin/*`, `/invite`

**Migration for OAuth clients:** clients that read the user with an
OAuth access token (e.g. `GET /user` / `supabase.auth.getUser()`) should
use `GET /oauth/userinfo` instead. It returns claims based on the
granted scopes:

- `sub`, always
- `email`, `email_verified` with the `email` scope
- `name`, `picture`, `preferred_username` with the `profile` scope
- phone claims with the `phone` scope

`app_metadata`, the full `user_metadata`, identities and factors are no
longer available to OAuth clients. This is intentional: they go beyond
what the user consented to.

18 of 18 new or added lines in 4 files covered. (100.0%)

16732 of 23338 relevant lines covered (71.69%)

498.85 hits per line