feat: add Client ID Metadata Document (CIMD) support for OAuth - #8205
feat: add Client ID Metadata Document (CIMD) support for OAuth#8205SahilJat wants to merge 1 commit into
Conversation
Implement CIMD resolution so that HTTPS URL client_ids are accepted at the authorise and token endpoints. The authorisation server fetches the client metadata document from the URL, validates it, and upserts a single Application row keyed by the URL — eliminating the row littering caused by anonymous DCR. Key changes: - Add oauth2_metadata/cimd.py with fetch, validate, and resolve logic - Wrap TokenView as CIMDTokenView to resolve CIMD clients before DOT - Hook _ensure_cimd_client into OAuthAuthorizeView (GET and POST) - Advertise client_id_metadata_document_supported: true in RFC 8414 - Add flagsmith_oauth2_cimd_resolutions_total Prometheus counter - Reject secret-based auth methods (no registration step for secrets) - Reject private_key_jwt as not yet implemented - Default missing token_endpoint_auth_method to 'none' - SSRF hardening: public DNS check, allow_redirects=False - Comprehensive unit and integration tests for all CIMD paths - DCR remains available for clients that do not implement CIMD
|
@SahilJat is attempting to deploy a commit to the Flagsmith Team on Vercel. A member of the Team first needs to authorize it. |
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Thanks for submitting a PR! Please check the boxes below:
docs/if required so people know about the feature.Changes
Contributes to #8141
Please describe.
How did you test this code?
Please describe.