Return error to RP instead of user for prompt=none

This commit is contained in:
theworldbright 2015-11-06 17:37:56 -08:00
parent 9fc8c63cae
commit c6bec2f2dc
2 changed files with 3 additions and 4 deletions

View file

@ -219,8 +219,8 @@ module Api
def auth_user_unless_prompt_none!
if params[:prompt] == "none" && !user_signed_in?
render json: {error: "login_required",
description: "User must be first logged in when `prompt` is `none`"}
handle_params_error("login_required",
"User must already be logged in when 'prompt' is 'none'")
else
authenticate_user!
end

View file

@ -141,8 +141,7 @@ describe Api::OpenidConnect::AuthorizationsController, type: :controller do
it "should return an interaction required error" do
post :new, client_id: client.client_id, redirect_uri: "http://localhost:3000/",
response_type: "id_token", scope: "openid", state: 1234, display: "page", prompt: "none"
json_body = JSON.parse(response.body)
expect(json_body["error"]).to match("login_required")
expect(response.location).to match("error=login_required")
end
end