Repository navigation
Mark client credentials tokens on the resource server user and verify the ephemeral token at registration #260
Description
Problem
packages/core/src/resourceServer.tsreturns client credentials tokens (subequal toclient_id) as aResourceServerUserwithidset to the client id and nothing marking it as a machine token, so adopters can treat it as a user idpackages/core/src/handlers/register.tssigns the ephemeral token into the registration cookie withoutverifyUpstreamSession(..., "ephemeral"), unlike the login handler and the manifest path
Fix
- add
isClientto the resource server user, and a guard option that requires a user - verify the ephemeral token in
registerHandlerbefore signing the cookie
Activity
test(core): reproduce client credentials tokens that look like users
fix(core): mark client credentials tokens on the resource server user
test(core): reproduce resource server guards that cannot require a user
feat: let verify-only resource servers require a user
fix: guard unsafe requests whatever the SameSite setting, and no refr…
feat: let verify-only resource servers require a user (#37)
feat: let verify-only resource servers require a user (#35)
Bccorb commentedon Nov 7, 2026
Done on main. packages/core/src/resourceServer.ts marks client credentials tokens with isClient, and the guards refuse them unless allowClients is set (the Go, Python and Rust adapters match, fells-code/seamless-auth-go#32, fells-code/seamless-auth-python#35, fells-code/seamless-auth-rust#37). registerHandler verifies the ephemeral token with verifyUpstreamSession before signing the registration cookie. Landed in #270.