Eagerly abort introspection/revocation demands that don't have a toke…

…n attached
openiddict · Nov 12, 2024 · d7be53a · d7be53a
1 parent 07e0df9
commit d7be53a
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/src/OpenIddict.Abstractions/OpenIddictResources.resx b/src/OpenIddict.Abstractions/OpenIddictResources.resx
@@ -1701,6 +1701,12 @@ To apply post-logout redirection responses, create a class implementing 'IOpenId
   <data name="ID0457" xml:space="preserve">
     <value>The '{0}' parameter cannot contain null or empty values.</value>
   </data>
+  <data name="ID0458" xml:space="preserve">
+    <value>A token must be specified when using introspection.</value>
+  </data>
+  <data name="ID0459" xml:space="preserve">
+    <value>A token must be specified when using revocation.</value>
+  </data>
   <data name="ID2000" xml:space="preserve">
     <value>The security token is missing.</value>
   </data>

diff --git a/src/OpenIddict.Client/OpenIddictClientHandlers.cs b/src/OpenIddict.Client/OpenIddictClientHandlers.cs
@@ -6171,6 +6171,11 @@ public ValueTask HandleAsync(ProcessIntrospectionContext context)
                 throw new ArgumentNullException(nameof(context));
             }
 
+            if (string.IsNullOrEmpty(context.Token))
+            {
+                throw new InvalidOperationException(SR.GetResourceString(SR.ID0458));
+            }
+
             if (context.Registration is null && string.IsNullOrEmpty(context.RegistrationId) &&
                 context.Issuer       is null && string.IsNullOrEmpty(context.ProviderName) &&
                 context.Options.Registrations.Count is not 1)
@@ -6841,6 +6846,11 @@ public ValueTask HandleAsync(ProcessRevocationContext context)
                 throw new ArgumentNullException(nameof(context));
             }
 
+            if (string.IsNullOrEmpty(context.Token))
+            {
+                throw new InvalidOperationException(SR.GetResourceString(SR.ID0459));
+            }
+
             if (context.Registration is null && string.IsNullOrEmpty(context.RegistrationId) &&
                 context.Issuer       is null && string.IsNullOrEmpty(context.ProviderName) &&
                 context.Options.Registrations.Count is not 1)