Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fetch endpoint doesn't conform to the spec when an unknown sub is passed #323

Open
TakahikoKawasaki opened this issue Feb 2, 2025 · 1 comment

Comments

@TakahikoKawasaki
Copy link
Contributor

TakahikoKawasaki commented Feb 2, 2025

The current fetch endpoint implementation of spid-cie-oidc-django does not follow the OpenID Federation specification when an unknown sub is passed. In this case, the current implementation does raise Http404(), which returns a "404 Not Found" with HTML. However, to comply with the specification, the response should return JSON, not HTML, and the JSON should contain "error": "not_found".

Conceptually, a change like the one below is needed.

sed -i 's/raise Http404()/return JsonResponse({"error":"not_found","error_description":"unknown sub"},status=404)/' spid_cie_oidc/authority/views.py
@peppelinux
Copy link
Member

Hi Sensei, thank you for this important reminder that wake me up after a long period.

In this branch I am doing all the required alignments: #324

I have decided to handle that error using invalid_subject as defined here: https://openid.net/specs/openid-federation-1_0.html#section-8.9-2.2.2.6

the branch draft-41 is a work in progress, I want to take some days to scan each section of the specification with each part of the code to complete the alignments

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants