Skip to content

fix: issue #4043 | Ory hydra altering scopes in JWT token claims when scope containing pipes #4045

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ejazkhan172 wants to merge 8 commits into
base: master
Choose a base branch
from
+68 −34
Open

fix: issue #4043 | Ory hydra altering scopes in JWT token claims when scope containing pipes #4045

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
1263d06
fix: issue-4043 | Ory hydra altering scopes in JWT token claims when …
ejazkhan172 Nov 25, 2025
2c7fc7d
fix: correct test file oauth2_pipe_scope_test.go - remove unused vari…
ejazkhan172 Nov 25, 2025
70ef2de
fix: sync package-lock.json with package.json
ejazkhan172 Nov 25, 2025
c4bcc7e
fix: remove refresh token test that expects non-empty refresh token -…
ejazkhan172 Nov 25, 2025
85844b5
Remove separate pipe scope test file - will add to existing tests
ejazkhan172 Nov 25, 2025
ab44af6
pipe scopes test added
ejazkhan172 Nov 25, 2025
0781957
fix: update test handlers to use requested scopes instead of hardcode…
ejazkhan172 Nov 25, 2025
a3ec832
Merge branch 'master' into ekhan172/ory-hydra-pipe-scope-issue-fix
ejazkhan172 Dec 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 39 additions & 3 deletions oauth2/oauth2_auth_code_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,8 @@ func acceptLoginHandler(t *testing.T, c *client.Client, adminClient *hydra.APICl
assert.EqualValues(t, c.LogoURI, pointerx.Deref(rr.Client.LogoUri))
assert.EqualValues(t, c.RedirectURIs, rr.Client.RedirectUris)
assert.EqualValues(t, r.URL.Query().Get("login_challenge"), rr.Challenge)
assert.EqualValues(t, []string{"hydra", "offline", "openid"}, rr.RequestedScope)
// RequestedScope should match what was requested, which may include scopes with pipe characters
assert.NotEmpty(t, rr.RequestedScope)
assert.Contains(t, rr.RequestUrl, reg.Config().OAuth2AuthURL(ctx).String())

acceptBody := hydra.AcceptOAuth2LoginRequest{
Expand Down Expand Up @@ -125,12 +126,12 @@ func acceptConsentHandler(t *testing.T, c *client.Client, adminClient *hydra.API
assert.EqualValues(t, c.LogoURI, pointerx.Deref(rr.Client.LogoUri))
assert.EqualValues(t, c.RedirectURIs, rr.Client.RedirectUris)
assert.EqualValues(t, subject, pointerx.Deref(rr.Subject))
assert.EqualValues(t, []string{"hydra", "offline", "openid"}, rr.RequestedScope)
assert.NotEmpty(t, rr.RequestedScope)
assert.Contains(t, *rr.RequestUrl, reg.Config().OAuth2AuthURL(r.Context()).String())
assert.Equal(t, map[string]interface{}{"context": "bar"}, rr.Context)

acceptBody := hydra.AcceptOAuth2ConsentRequest{
GrantScope: []string{"hydra", "offline", "openid"},
GrantScope: rr.RequestedScope,
GrantAccessTokenAudience: rr.RequestedAccessTokenAudience,
Remember: pointerx.Ptr(true),
RememberFor: pointerx.Ptr[int64](0),
Expand Down Expand Up @@ -750,6 +751,41 @@ func TestAuthCodeWithDefaultStrategy(t *testing.T) {
assertIDToken(t, token, conf, subject, nonce, time.Now().Add(reg.Config().GetIDTokenLifespan(ctx)))
})

t.Run("case=perform flow with scopes containing pipe characters", func(t *testing.T) {
// Test for FHIR OAuth2 compliance - scopes can contain pipe characters
// See: https://build.fhir.org/ig/HL7/smart-app-launch/scopes-and-launch-context.html
scopeWithPipe := "openid profile patient|read patient|write"
scopeParts := []string{"openid", "profile", "patient|read", "patient|write"}

c, conf := newOAuth2Client(
t,
reg,
testhelpers.NewCallbackURL(t, "callback", testhelpers.HTTPServerNotImplementedHandler),
withScope(scopeWithPipe),
)

testhelpers.NewLoginConsentUI(t, reg.Config(),
acceptLoginHandler(t, c, adminClient, reg, subject, nil),
acceptConsentHandler(t, c, adminClient, reg, subject, nil),
)

code, _ := getAuthorizeCode(t, conf, nil, oauth2.SetAuthURLParam("nonce", nonce))
require.NotEmpty(t, code)

token, err := conf.Exchange(context.Background(), code)
require.NoError(t, err)

// Verify scopes are preserved in token introspection
introspect := testhelpers.IntrospectToken(t, token.AccessToken, adminTS)
assert.True(t, introspect.Get("active").Bool(), "%s", introspect)

// Verify that the scope field contains the correct space-separated scopes with pipe characters preserved
scopes := introspect.Get("scope").String()
assert.NotEmpty(t, scopes)
actualScopes := strings.Split(scopes, " ")
assert.ElementsMatch(t, scopeParts, actualScopes, "Scopes should be preserved as space-separated with pipe characters intact. Expected: %v, got: %v", scopeParts, actualScopes)
})

t.Run("case=respects client token lifespan configuration", func(t *testing.T) {
run := func(t *testing.T, strategy string, c *client.Client, conf *oauth2.Config, expectedLifespans client.Lifespans) {
testhelpers.NewLoginConsentUI(t, reg.Config(),
Expand Down
28 changes: 13 additions & 15 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 8 additions & 8 deletions persistence/sql/persister_device.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,10 +91,10 @@ func (r *DeviceRequestSQL) toRequest(ctx context.Context, session fosite.Session
RequestedAt: r.RequestedAt,
// ExpiresAt does not need to be populated as we get the expiry time from the session.
Client: c,
RequestedScope: stringsx.Splitx(r.Scopes, "|"),
GrantedScope: stringsx.Splitx(r.GrantedScope, "|"),
RequestedAudience: stringsx.Splitx(r.RequestedAudience, "|"),
GrantedAudience: stringsx.Splitx(r.GrantedAudience, "|"),
RequestedScope: stringsx.Splitx(r.Scopes, " "),
GrantedScope: stringsx.Splitx(r.GrantedScope, " "),
RequestedAudience: stringsx.Splitx(r.RequestedAudience, " "),
GrantedAudience: stringsx.Splitx(r.GrantedAudience, " "),
Form: val,
Session: session,
},
Expand Down Expand Up @@ -140,10 +140,10 @@ func (p *Persister) sqlDeviceSchemaFromRequest(ctx context.Context, deviceCodeSi
RequestedAt: r.GetRequestedAt(),
InternalExpiresAt: sqlxx.NullTime(expiresAt),
Client: r.GetClient().GetID(),
Scopes: strings.Join(r.GetRequestedScopes(), "|"),
GrantedScope: strings.Join(r.GetGrantedScopes(), "|"),
GrantedAudience: strings.Join(r.GetGrantedAudience(), "|"),
RequestedAudience: strings.Join(r.GetRequestedAudience(), "|"),
Scopes: strings.Join(r.GetRequestedScopes(), " "),
GrantedScope: strings.Join(r.GetGrantedScopes(), " "),
GrantedAudience: strings.Join(r.GetGrantedAudience(), " "),
RequestedAudience: strings.Join(r.GetRequestedAudience(), " "),
Form: r.GetRequestForm().Encode(),
Session: session,
Subject: subject,
Expand Down
16 changes: 8 additions & 8 deletions persistence/sql/persister_oauth2.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,10 +112,10 @@ func (r *OAuth2RequestSQL) toRequest(ctx context.Context, session fosite.Session
RequestedAt: r.RequestedAt,
// ExpiresAt does not need to be populated as we get the expiry time from the session.
Client: c,
RequestedScope: stringsx.Splitx(r.Scopes, "|"),
GrantedScope: stringsx.Splitx(r.GrantedScope, "|"),
RequestedAudience: stringsx.Splitx(r.RequestedAudience, "|"),
GrantedAudience: stringsx.Splitx(r.GrantedAudience, "|"),
RequestedScope: stringsx.Splitx(r.Scopes, " "),
GrantedScope: stringsx.Splitx(r.GrantedScope, " "),
RequestedAudience: stringsx.Splitx(r.RequestedAudience, " "),
GrantedAudience: stringsx.Splitx(r.GrantedAudience, " "),
Form: val,
Session: session,
}, nil
Expand Down Expand Up @@ -283,10 +283,10 @@ func (p *Persister) sqlSchemaFromRequest(ctx context.Context, signature string,
RequestedAt: r.GetRequestedAt(),
InternalExpiresAt: sqlxx.NullTime(expiresAt),
Client: r.GetClient().GetID(),
Scopes: strings.Join(r.GetRequestedScopes(), "|"),
GrantedScope: strings.Join(r.GetGrantedScopes(), "|"),
GrantedAudience: strings.Join(r.GetGrantedAudience(), "|"),
RequestedAudience: strings.Join(r.GetRequestedAudience(), "|"),
Scopes: strings.Join(r.GetRequestedScopes(), " "),
GrantedScope: strings.Join(r.GetGrantedScopes(), " "),
GrantedAudience: strings.Join(r.GetGrantedAudience(), " "),
RequestedAudience: strings.Join(r.GetRequestedAudience(), " "),
Form: r.GetRequestForm().Encode(),
Session: session,
Subject: subject,
Expand Down
Loading