Store offline sessions only if they were requested by the user (#3125)

Signed-off-by: MM53 <2821Signed-off-by: MM53 <28218664+MM53@users.noreply.github.com>
dexidp · Oct 20, 2023 · efc2fdb · efc2fdb
1 parent 85d88ff
commit efc2fdb
Show file tree

Hide file tree

Showing 2 changed files with 227 additions and 104 deletions.
diff --git a/server/handlers.go b/server/handlers.go
@@ -539,6 +539,17 @@ func (s *Server) finalizeLogin(identity connector.Identity, authReq storage.Auth
 		return returnURL, false, nil
 	}
 
+	offlineAccessRequested := false
+	for _, scope := range authReq.Scopes {
+		if scope == scopeOfflineAccess {
+			offlineAccessRequested = true
+			break
+		}
+	}
+	if !offlineAccessRequested {
+		return returnURL, false, nil
+	}
+
 	// Try to retrieve an existing OfflineSession object for the corresponding user.
 	session, err := s.storage.GetOfflineSessions(identity.UserID, authReq.ConnectorID)
 	if err != nil {