Repository: dexidp/dex
Pull request #3441 (2024-03-30 15:51:27)

fix: wrong error code returned in case of inactive token
#### What this PR does / why we need it
While making #3404 I made a mistake and set inactive token to a status code `401` where it should be `200`

https://datatracker.ietf.org/doc/html/rfc7662#section-2.2 
```
   If the introspection call is properly authorized but the token is not
   active, does not exist on this server, or the protected resource is
   not allowed to introspect this particular token, then the
   authorization server MUST return an introspection response with the
   "active" field set to "false".  Note that to avoid disclosing too
   much of the authorization server's state to a third party, the
   authorization server SHOULD NOT include any additional information
   about an inactive token, including why the token is inactive.

   The following is a non-normative example response for a token that
   has been revoked or is otherwise invalid:

     HTTP/1.1 200 OK
     Content-Type: application/json

     {
      "active": false
     }
```

Also in Auth0 page:
https://www.oauth.com/oauth2-servers/token-introspection-endpoint/
```
In any of these cases, it is not considered an error response, and the endpoint returns simply an inactive flag.

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
 
{
  "active": false
}
```



Patch:
diff --git a/server/introspectionhandler.go b/server/introspectionhandler.go
index a33f20bd..f0d1f807 100644
--- a/server/introspectionhandler.go
+++ b/server/introspectionhandler.go
@@ -340,7 +340,7 @@ func introspectInactiveErr(w http.ResponseWriter) {
 	w.Header().Set("Cache-Control", "no-store")
 	w.Header().Set("Pragma", "no-cache")
 	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(401)
+	w.WriteHeader(200)
 	json.NewEncoder(w).Encode(struct {
 		Active bool `json:"active"`
 	}{Active: false})


Test patch:
diff --git a/server/introspectionhandler_test.go b/server/introspectionhandler_test.go
index 07504c4e..2b17c2e9 100644
--- a/server/introspectionhandler_test.go
+++ b/server/introspectionhandler_test.go
@@ -300,7 +300,7 @@ func TestHandleIntrospect(t *testing.T) {
 			testName:           "Access Token: wrong",
 			token:              "fake-token",
 			response:           inactiveResponse,
-			responseStatusCode: 401,
+			responseStatusCode: 200,
 		},
 		// Refresh token tests
 		{
@@ -313,13 +313,13 @@ func TestHandleIntrospect(t *testing.T) {
 			testName:           "Refresh Token: expired",
 			token:              expiredRefreshToken,
 			response:           inactiveResponse,
-			responseStatusCode: 401,
+			responseStatusCode: 200,
 		},
 		{
 			testName:           "Refresh Token: active => false (wrong)",
 			token:              "fake-token",
 			response:           inactiveResponse,
-			responseStatusCode: 401,
+			responseStatusCode: 200,
 		},
 	}
 
@@ -380,7 +380,7 @@ func TestIntrospectErrHelper(t *testing.T) {
 		{
 			testName:      "Inactive Token",
 			err:           newIntrospectInactiveTokenError(),
-			resStatusCode: http.StatusUnauthorized,
+			resStatusCode: http.StatusOK,
 			resBody:       "{\"active\":false}\n",
 		},
 		{