consent: Returns an error if skip is used together with remember
Previously, it was possible to remember an already remembered consent/login request. This patch resolves that.
@@ -140,6 +140,9 @@ func (h *Handler) AcceptLoginRequest(w http.ResponseWriter, r *http.Request, ps
} else if ar.Subject != "" && p.Subject != ar.Subject {
h.H.WriteErrorCode(w, r, http.StatusBadRequest, errors.New("Subject from payload does not match subject from previous authentication"))
return
+ } else if ar.Skip && p.Remember {
+ h.H.WriteErrorCode(w, r, http.StatusBadRequest, errors.New("Can not remember authentication because no user interaction was required"))
+ return
}
request, err := h.M.HandleAuthenticationRequest(ps.ByName("challenge"), &p)
@@ -303,6 +306,9 @@ func (h *Handler) AcceptConsentRequest(w http.ResponseWriter, r *http.Request, p
if err != nil {
h.H.WriteError(w, r, errors.WithStack(err))
return
+ } else if hr.Skip && p.Remember {
+ h.H.WriteErrorCode(w, r, http.StatusBadRequest, errors.New("Can not remember consent because no user interaction was required"))
+ return
}
ru, err := url.Parse(hr.RequestURL)
