fix: support space-separated OIDC prompt parameter values#4083
fix: support space-separated OIDC prompt parameter values#4083raajheshkannaa wants to merge 1 commit intoory:masterfrom
Conversation
The OIDC spec allows multiple prompt values separated by spaces (e.g. "select_account consent"). The validator already handled this correctly by splitting on spaces, but GenerateIDToken in strategy_jwt.go used a switch statement on the raw unsplit string, causing prompt values like "login consent" to skip login-specific validation. Split the prompt parameter by space in GenerateIDToken and use slices.Contains to check for individual values, consistent with how the validator and consent strategy already handle it. Fixes ory#4039
|
The failing This PR only modifies OpenID Connect prompt handling logic in Go source files and does not touch Docker images, dependencies, or the Dockerfile. Could a maintainer re-trigger the check or add an exception for this known vulnerability so the PR can proceed? |
|
Friendly ping. The failing scanners check is a pre-existing CVE in the base image, not introduced by this PR. Could a maintainer re-trigger or exempt it? Happy to help if there's anything else needed. |
1 participant
Fixes #4039
promptas a space-separated list of valuesselect_account consentslices.Containsto check for each recognized value