Fix: Add authorization code to token exchange step for all affected versions (Product IS issue #26237) #5702
Conversation
…ersions (product-is#26237)
|
wso2-engineering-bot seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. You have signed the CLA already but the status is still pending? Let us recheck it. |
WalkthroughDocumentation update to the app-native authentication guide adding a token exchange section explaining how to exchange authorization codes for access tokens at the /token endpoint. Includes sample requests, responses, and parameter descriptions duplicated across two scenarios. Changes
Sequence DiagramsequenceDiagram
participant Client as Client Application
participant AuthServer as Authorization Server
participant TokenEndpoint as /token Endpoint
Client->>AuthServer: 1. User authorizes app
AuthServer->>Client: 2. Returns authorization code
rect rgb(200, 220, 255)
Note over Client,TokenEndpoint: Token Exchange (newly documented)
Client->>TokenEndpoint: POST /token with<br/>authorization code
TokenEndpoint->>TokenEndpoint: Validate code & redirect_uri
TokenEndpoint->>Client: Returns access_token,<br/>refresh_token, id_token, etc.
end
Client->>Client: Uses access_token for API calls
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
en/includes/references/app-native-authentication.md (1)
244-949: Clarify: Should scenarios show the complete token exchange step?The five scenarios (Scenario 1–5) document authentication flows up to receiving the authorization code but don't include the token exchange step added in step 8. This may be intentional (scenarios focus on authentication steps only, with token exchange shown separately in the main flow), or it could be an oversight.
If the intent is to show end-to-end flows for users, consider whether one or more scenarios should be updated to include the token exchange. If this is by design, the current approach is fine—just worth confirming.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
en/includes/references/app-native-authentication.md(1 hunks)
🧰 Additional context used
🪛 Gitleaks (8.29.0)
en/includes/references/app-native-authentication.md
[high] 222-222: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
[high] 223-223: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
[high] 225-225: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
(generic-api-key)
🔇 Additional comments (1)
en/includes/references/app-native-authentication.md (1)
189-239: Approve content; note Gitleaks false-positive warnings on example tokens.The new step 8 appropriately completes the OAuth 2.0 flow documentation. Content is well-structured, technically accurate (correct grant type, required parameters, token response fields), and aligns with existing documentation style. Parameter descriptions are clear and the important redirect_uri matching note is included.
The Gitleaks warnings flagging lines 222, 223, and 225 are likely false positives—these are clearly example/dummy tokens in a documentation context (indicated by truncation and format). However, automated scans may flag these as credentials. This is worth monitoring during CI/CD verification, and you may consider adjusting example token formats (e.g., using more obviously synthetic values or documented placeholder patterns) if these alerts become problematic in your pipeline.
This PR was automatically generated by Claude AI.
Changes made
Added a new step 8 titled "Exchange authorization code for tokens" to the app-native authentication documentation that includes:
/oauth2/tokenendpointgrant_type,code,redirect_uri,client_id,client_secretaccess_token- Token for accessing protected resourcesrefresh_token- Token for obtaining new access tokensid_token- JWT containing user identity informationtoken_type- Type of token (Bearer)expires_in- Token lifetime in secondsscope- Granted scopesredirect_urimust match the initial authorization requestAffected versions
This fix applies to all versions that support app-native authentication:
The change was made to the shared include file (
en/includes/references/app-native-authentication.md), ensuring consistent documentation across all versions.Style scope verification
Microsoft Style Guidelines have been applied to the newly added step 8 content, including:
Existing content in the document was not modified to ensure style compliance is limited to new additions only.
Verification
Summary by CodeRabbit