Issue ouverte · Issue #1006 Introspection endpoint answers without authorization · @rmdes
The introspection endpoint answers without any authorization. introspectionController in packages/endpoint-auth/lib/controllers/introspection.js returns { active: true, ...claims } for any valid token posted to /auth/introspect (or sent to GET /auth/token), so anyone holding a token can read back who it belongs to and its scope. The IndieAuth spec asks for the introspection endpoint to require some form of authorization.
This fails S801 and S802 in the IndieAuth test suite: https://dev.indieauth.rocks/implementations/2 (run against main, see #967).
Before a PR, a question on the form it should take. Core’s introspectToken (packages/indiekit/lib/token.js) sends the token being checked as its own Bearer header, so requiring a bearer token would only mean a token can introspect itself. Should Indiekit’s own calls skip the HTTP round trip and verify locally when the endpoint is its own, with the HTTP endpoint requiring a separate credential (for example a token with a dedicated scope), or is self-introspection with a bearer token enough here?