Bump doorkeeper from 5.9.3 to 5.9.6 - #4674

Sourced from doorkeeper's releases.

v5.9.6

• Reject requests that present more than one client identity (e.g. an Authorization: Basic header for one client and a client_id parameter naming another) with an invalid_request error, instead of authenticating the first extracted identity and silently discarding the other one. A client_id sent alongside another authentication method keeps working when it identifies the same client (RFC 7521 §4.2). Like the RFC 6749 §2.3 check released in 5.9.5, this validation does not apply when client_credentials is configured with a callable extractor, since the credentials the remaining extractors would return are never evaluated — the client_credentials option documents that now.

v5.9.5

• #1901 Reject requests that authenticate the client with more than one method (RFC 6749 §2.3) with an invalid_request error, instead of silently authenticating with the first method that matched and discarding the other credentials.
• #1853 Fix reuse_access_token reusing a token that was created with custom_access_token_attributes values when the new request doesn't specify any custom attributes. Such requests now only match tokens without custom attributes.

Sourced from doorkeeper's changelog.

5.9.6

• Reject requests that present more than one client identity (e.g. an Authorization: Basic header for one client and a client_id parameter naming another) with an invalid_request error, instead of authenticating the first extracted identity and silently discarding the other one. A client_id sent alongside another authentication method keeps working when it identifies the same client (RFC 7521 §4.2). Like the RFC 6749 §2.3 check released in 5.9.5, this validation does not apply when client_credentials is configured with a callable extractor, since the credentials the remaining extractors would return are never evaluated — the client_credentials option documents that now.

5.9.5

• #1901 Reject requests that authenticate the client with more than one method (RFC 6749 §2.3) with an invalid_request error, instead of silently authenticating with the first method that matched and discarding the other credentials.
• #1853 Fix reuse_access_token reusing a token that was created with custom_access_token_attributes values when the new request doesn't specify any custom attributes. Such requests now only match tokens without custom attributes.

• 75a84fe Release 5.9.6
• 41cae2f Merge commit from fork
• 2b93d10 Document that a callable client_credentials extractor opts out of the checks
• 2c88e05 Pin that a blank client_id in the params is treated as omitted
• 13b0087 Reject requests presenting more than one client identity (RFC 6749 §2.3)
• 4a87582 Release 5.9.5
• 896ca00 Merge commit from fork
• f9e8097 Reject requests using multiple client authentication methods (RFC 6749 §2.3)
• 932c966 Merge pull request #1856 from 55728/backport/v5.9-stable/custom-attributes-to...
• 696cdc0 Merge pull request #1853 from 55728/fix/custom-attributes-token-reuse
• See full diff in compare view