Merge pull request #637 from frankie567/fix/oidc-guess-prompt

fix: OIDC "login" prompt should be "login" even if user authenticated
lepture · Nov 27, 2024 · 858f7d9 · 858f7d9
2 parents 1cba980 + 876ae27
commit 858f7d9
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/authlib/oidc/core/grants/util.py b/authlib/oidc/core/grants/util.py
@@ -114,7 +114,7 @@ def create_response_mode_response(redirect_uri, params, response_mode):
 def _guess_prompt_value(end_user, prompts, redirect_uri, redirect_fragment):
     # http://openid.net/specs/openid-connect-core-1_0.html#AuthRequest
 
-    if not end_user and 'login' in prompts:
+    if not end_user or 'login' in prompts:
         return 'login'
 
     if 'consent' in prompts:

diff --git a/tests/flask/test_oauth2/test_openid_code_grant.py b/tests/flask/test_oauth2/test_openid_code_grant.py
@@ -163,6 +163,10 @@ def test_prompt(self):
         rv = self.client.get('/oauth/authorize?' + query)
         self.assertEqual(rv.data, b'login')
 
+        query = url_encode(params + [('user_id', '1'), ('prompt', 'login')])
+        rv = self.client.get('/oauth/authorize?' + query)
+        self.assertEqual(rv.data, b'login')
+
 
 class RSAOpenIDCodeTest(BaseTestCase):
     def config_app(self):