OAuth2 goodies for the Djangonauts!
This report summarizes scanner evidence for django-oauth/django-oauth-toolkit, a Python project with 3,343 GitHub stars. SynthScan examined 134,186 lines of code across 396 source files, recording 2459 pattern matches distributed across 18 syntactic categories. The legacy adjusted pattern signal is 22.4 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 2120 finding(s).
Are imports declared and package/API names verified? 154 finding(s).
Are wrappers, guards, and repeated structures necessary? 2164 finding(s).
Which changes need focused human review? 2459 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 2459 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_www_authenticate.py | 24 | def test_bare_bearer_when_nothing_to_advertise(self): | CODE |
| LOW | tests/test_www_authenticate.py | 28 | def test_includes_error_and_resource_metadata(self): | CODE |
| LOW⚡ | tests/test_www_authenticate.py | 42 | def test_explicit_resource_metadata_url_overrides_default(self): | CODE |
| LOW⚡ | tests/test_www_authenticate.py | 50 | def test_explicit_none_omits_resource_metadata(self): | CODE |
| LOW⚡ | tests/test_www_authenticate.py | 55 | def test_quoted_string_values_are_escaped(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 32 | def test_malformed_bearer_header_no_token(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 42 | def test_malformed_bearer_header_empty_token(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 74 | def test_invalid_bearer_token(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 84 | def test_invalid_bearer_token_logs_at_debug_level(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 98 | def test_no_authorization_header(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 107 | def test_non_bearer_authorization_header(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 127 | def test_case_insensitive_bearer_scheme(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 140 | def test_scheme_starting_with_bearer_is_rejected(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 150 | def test_whitespace_variations(self): | CODE |
| LOW | tests/test_client_branding.py | 49 | def test_shows_logo_and_links(self): | CODE |
| LOW⚡ | tests/test_client_branding.py | 74 | def test_logo_alt_falls_back_to_client_id(self): | CODE |
| LOW⚡ | tests/test_client_branding.py | 80 | def test_only_registered_links_are_shown(self): | CODE |
| LOW⚡ | tests/test_client_branding.py | 88 | def test_nothing_shown_without_display_metadata(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 73 | def test_json_body_keeps_legacy_error(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 87 | def test_multipart_body_is_accepted(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 94 | def test_non_compliant_body_warns_about_the_coming_default(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 107 | def test_compliant_body_does_not_warn(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 118 | def test_get_request_does_not_warn(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 140 | def test_form_encoded_body_is_accepted(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 147 | def test_charset_parameter_is_accepted(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 156 | def test_json_body_is_rejected(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 168 | def test_multipart_body_is_rejected(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 174 | def test_missing_content_type_is_rejected(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 180 | def test_every_form_encoded_endpoint_is_covered(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 190 | def test_get_requests_are_unaffected(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 202 | def test_disabled_endpoint_still_reports_not_found(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 220 | def test_json_registration_still_succeeds(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 245 | def test_userinfo_post_is_not_rejected(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 260 | def test_no_error_when_only_the_gate_is_set(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 265 | def test_no_error_when_only_the_json_backend_is_set(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 271 | def test_error_when_the_json_backend_can_never_be_reached(self): | CODE |
| LOW | tests/test_admin.py | 62 | def test_mask_credential_hides_the_secret(): | CODE |
| LOW | tests/test_admin.py | 81 | def _assert_hidden_on_change_form(admin_class, model, field, masked_field): | CODE |
| LOW | tests/test_admin.py | 95 | def test_credential_admins_disable_add(): | CODE |
| LOW | tests/test_admin.py | 108 | def test_admin_overrides_preserve_subclass_config(): | CODE |
| LOW⚡ | tests/test_admin.py | 129 | def _assert_searchable_by_app_and_user(admin_class): | CODE |
| LOW⚡ | tests/test_admin.py | 137 | def test_access_token_admin_does_not_expose_token(): | CODE |
| LOW⚡ | tests/test_admin.py | 144 | def test_refresh_token_admin_does_not_expose_token(): | CODE |
| LOW⚡ | tests/test_admin.py | 151 | def test_grant_admin_does_not_expose_code(): | CODE |
| LOW⚡ | tests/test_admin.py | 158 | def test_stored_request_admin_does_not_expose_request_uri(): | CODE |
| LOW⚡ | tests/test_admin.py | 170 | def test_id_token_admin_searchable_by_app_and_user(): | CODE |
| LOW⚡ | tests/test_admin.py | 176 | def test_credential_admins_delete_policy(): | CODE |
| LOW | tests/test_admin.py | 218 | def test_access_token_admin_revoke_action_revokes_token_family(): | CODE |
| LOW | tests/test_admin.py | 242 | def test_access_token_admin_revoke_action_without_refresh_token_deletes(): | CODE |
| LOW | tests/test_admin.py | 259 | def test_refresh_token_admin_revoke_action_revokes_token_family(): | CODE |
| LOW | tests/test_admin.py | 282 | def test_application_admin_exposes_can_introspect(): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 140 | def test_authenticate_basic_auth_hashed_secret(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 145 | def test_authenticate_basic_auth_unhashed_secret(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 154 | def test_authenticate_basic_auth_default_encoding(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 159 | def test_authenticate_basic_auth_wrong_client_id(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 164 | def test_authenticate_basic_auth_wrong_client_secret(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 169 | def test_authenticate_basic_auth_wrong_client_secret_not_logged(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 177 | def test_authenticate_request_body_wrong_client_secret_not_logged(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 185 | def test_authenticate_basic_auth_undecodable_credentials_not_logged(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 227 | def test_authenticate_basic_auth_public_app_with_device_code(self): | CODE |
| 1915 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | tests/test_bcp_rfc9700.py | 76 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_bcp_rfc9700.py | 78 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_bcp_rfc9700.py | 340 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_bcp_rfc9700.py | 342 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_bcp_rfc9700.py | 671 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_bcp_rfc9700.py | 673 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 41 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 43 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 121 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 123 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 296 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 298 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 526 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 528 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_device.py | 256 | # -------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_device.py | 258 | # -------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_device.py | 268 | # ------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_device.py | 270 | # ------------------------- | COMMENT |
| MEDIUM | tests/test_device.py | 139 | # ----------------------- | COMMENT |
| MEDIUM | tests/test_device.py | 142 | # ----------------------- | COMMENT |
| MEDIUM | tests/test_device.py | 197 | # -------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_device.py | 200 | # -------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_device.py | 242 | # -------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_device.py | 245 | # -------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_dcr_views.py | 1185 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_dcr_views.py | 1187 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_dcr_views.py | 2121 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_dcr_views.py | 2123 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_dcr_views.py | 2579 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_dcr_views.py | 2581 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 26 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 28 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 58 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 60 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 1042 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 1044 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 1109 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 1112 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 2292 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 2294 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 2391 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 2393 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 2417 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 2419 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 2477 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 2479 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 2658 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 2660 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 180 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 182 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 231 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 233 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 313 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 315 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 933 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 936 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 974 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 976 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 990 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 992 | # --------------------------------------------------------------------------- | COMMENT |
| 44 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_implicit.py | 0 | test for default redirect uri if omitted from query string with response_type: code | STRING |
| HIGH | tests/test_authorization_code.py | 0 | test for default redirect uri if omitted from query string with response_type: code | STRING |
| HIGH | tests/test_hybrid.py | 0 | test for default redirect uri if omitted from query string with response_type: code | STRING |
| HIGH | tests/test_implicit.py | 0 | test error when passing a forbidden redirect_uri in query string with response_type: code | STRING |
| HIGH | tests/test_authorization_code.py | 0 | test error when passing a forbidden redirect_uri in query string with response_type: code | STRING |
| HIGH | tests/test_hybrid.py | 0 | test error when passing a forbidden redirect_uri in query string with response_type: code | STRING |
| HIGH | tests/test_implicit.py | 0 | test authorization code is given for an allowed request with response_type: code | STRING |
| HIGH | tests/test_authorization_code.py | 0 | test authorization code is given for an allowed request with response_type: code | STRING |
| HIGH | tests/test_hybrid.py | 0 | test authorization code is given for an allowed request with response_type: code | STRING |
| HIGH | tests/test_implicit.py | 0 | if application.skip_authorization = true, should skip the authorization page. | STRING |
| HIGH | tests/test_authorization_code.py | 0 | if application.skip_authorization = true, should skip the authorization page. | STRING |
| HIGH | tests/test_hybrid.py | 0 | if application.skip_authorization = true, should skip the authorization page. | STRING |
| HIGH | tests/test_implicit.py | 0 | tests that a redirection uri with query string is allowed and query string is retained on redirection. see https://rfc-e | STRING |
| HIGH | tests/test_authorization_code.py | 0 | tests that a redirection uri with query string is allowed and query string is retained on redirection. see https://rfc-e | STRING |
| HIGH | tests/test_hybrid.py | 0 | tests that a redirection uri with query string is allowed and query string is retained on redirection. see https://rfc-e | STRING |
| HIGH | tests/test_implicit.py | 0 | tests that a redirection uri is matched using scheme + netloc + path | STRING |
| HIGH | tests/test_authorization_code.py | 0 | tests that a redirection uri is matched using scheme + netloc + path | STRING |
| HIGH | tests/test_hybrid.py | 0 | tests that a redirection uri is matched using scheme + netloc + path | STRING |
| HIGH | oauth2_provider/scopes.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/signals.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/compat.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/oauth2_backends.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/checks.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/bcp.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/forms.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/backends.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/utils.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/http.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/exceptions.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/cimd.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/www_authenticate.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/middleware.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/dcr.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/decorators.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/oidc.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/token.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/device.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/generic.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/dynamic_client_registration.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/introspect.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/application.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/base.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/core/backends_oauthlib.py | 0 | a wrapper method that calls create_userinfo_response on the `server_class` instance. :param request: the current django. | STRING |
| HIGH | oauth2_provider/authorization_server/views/mixins.py | 0 | a wrapper method that calls create_userinfo_response on the `server_class` instance. :param request: the current django. | STRING |
| HIGH | oauth2_provider/resource_server/mixins.py | 0 | a wrapper method that calls create_userinfo_response on the `server_class` instance. :param request: the current django. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | tests/test_oauth2_validators.py | 18 | from oauth2_provider.core.exceptions import FatalClientError | CODE |
| CRITICAL | tests/test_oidc_claims_parameter.py | 16 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | tests/oracle_settings.py | 6 | # django.db.backends.oracle.utils.dsn() passes NAME to makedsn() as a *SID* whenever PORT is | COMMENT |
| CRITICAL | tests/test_authorization_request_objects.py | 20 | from oauth2_provider.core.exceptions import OAuthToolkitError | CODE |
| CRITICAL | tests/test_dcr_views.py | 956 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL⚡ | tests/test_resource_validators.py | 436 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL⚡ | tests/test_resource_validators.py | 442 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/models.py | 551 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/models.py | 832 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/validators.py | 5 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/core/backends_oauthlib.py | 21 | from oauth2_provider.core.exceptions import FatalClientError, OAuthToolkitError | CODE |
| CRITICAL | …uth2_provider/management/commands/createapplication.py | 3 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/authorization_server/cimd.py | 29 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/authorization_server/views/mixins.py | 16 | from oauth2_provider.core.exceptions import FatalClientError | CODE |
| CRITICAL | oauth2_provider/authorization_server/views/device.py | 5 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | …horization_server/views/dynamic_client_registration.py | 17 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/authorization_server/views/par.py | 11 | from oauth2_provider.core.exceptions import OAuthToolkitError | CODE |
| CRITICAL | oauth2_provider/authorization_server/views/base.py | 52 | from oauth2_provider.core.exceptions import FatalClientError, OAuthToolkitError | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | tests/test_oidc_claims_parameter.py | 1038 | '{"userinfo": {"\\ud800": null}}', | CODE |
| HIGH⚡ | tests/test_oidc_claims_parameter.py | 1040 | '{"userinfo": {"name\\u0000": null}}', | CODE |
| HIGH⚡ | tests/test_oidc_views.py | 279 | """Required OIDC endpoints must fail fast, not emit null, when unreversible.""" | STRING |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 112 | response = self.push(extra={"request_uri": f"{REQUEST_URI_PREFIX}abc"}) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 117 | response = self.push(extra={"request": "eyJ.abc.def"}) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 156 | response = self.push(auth=False) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 197 | response = self.push(extra={"redirect_uri": "http://not-registered.example"}) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 202 | response = self.push(extra={"client_id": self.public_application.client_id}) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 209 | response = self.push() | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 572 | push = self.push() | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 681 | push = self.push(extra={"prompt": "login"}) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 694 | response = self.push(extra={"scope": "openid read", "max_age": "abc"}) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 698 | response = self.push(extra={"scope": "openid read", "max_age": "60"}) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 705 | request_uri = json.loads(self.push(extra={"scope": "openid read"}).content)["request_uri"] | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 716 | request_uri = json.loads(self.push().content)["request_uri"] | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 729 | response = self.push(extra={"scope": "openid read", "max_age": "0"}, QUERY_STRING="max_age=999999") | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 733 | response = self.push(extra={"prompt": ["login", "none"]}) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 738 | request_uri = json.loads(self.push(extra={"prompt": "login"}).content)["request_uri"] | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 753 | first = json.loads(self.push(extra={"prompt": "login"}).content)["request_uri"] | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 758 | second = json.loads(self.push(extra={"prompt": "login"}).content)["request_uri"] | CODE |
| HIGH | tests/test_pushed_authorization_request.py | 94 | response = self.push() | CODE |
| HIGH | tests/test_pushed_authorization_request.py | 276 | response = self.push( | CODE |
| HIGH | tests/test_pushed_authorization_request.py | 403 | push = self.push() | CODE |
| HIGH | tests/test_pushed_authorization_request.py | 418 | push = self.push(extra={"response_mode": "fragment"}) | CODE |
| HIGH | tests/test_pushed_authorization_request.py | 626 | push = self.push( | CODE |
| HIGH | tests/test_pushed_authorization_request.py | 659 | push = self.push(extra={"scope": "openid read", "max_age": "60"}) | CODE |
| HIGH⚡ | tests/test_oidc_request_objects.py | 895 | "claims": ['{"id_token": {"acr": null}}'], | CODE |
| HIGH⚡ | tests/test_cimd.py | 944 | assert _build_application_kwargs(null)["userinfo_signed_response_alg"] == "" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/mysql_settings.py | 5 | CODE | |
| LOW | tests/settings_swapped.py | 1 | CODE | |
| LOW | tests/test_import_compat.py | 317 | CODE | |
| LOW | tests/multi_db_settings.py | 3 | CODE | |
| LOW | tests/mysql_pr_settings.py | 5 | CODE | |
| LOW | tests/oracle_settings.py | 3 | CODE | |
| LOW | tests/multi_db_settings_invalid_token_configuration.py | 1 | CODE | |
| LOW | tests/postgres_pr_settings.py | 3 | CODE | |
| LOW | tests/postgres_settings.py | 3 | CODE | |
| LOW | tests/openid-conformance-suite/run.py | 30 | CODE | |
| LOW | tests/openid-conformance-suite/baseline.py | 28 | CODE | |
| LOW | oauth2_provider/models.py | 37 | CODE | |
| LOW | oauth2_provider/validators.py | 13 | CODE | |
| LOW | oauth2_provider/apps.py | 10 | CODE | |
| LOW | oauth2_provider/apps.py | 13 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 61 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 61 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 61 | CODE | |
| LOW | oauth2_provider/core/compat.py | 8 | CODE | |
| LOW | oauth2_provider/resource_server/__init__.py | 14 | CODE | |
| LOW | oauth2_provider/resource_server/__init__.py | 14 | CODE | |
| LOW | oauth2_provider/contrib/ninja/__init__.py | 1 | CODE | |
| LOW | oauth2_provider/contrib/ninja/__init__.py | 2 | CODE | |
| LOW | oauth2_provider/contrib/ninja/__init__.py | 2 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 2 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 2 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 3 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 3 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 3 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 3 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 3 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 10 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 10 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 19 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 19 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 24 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 25 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 25 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 25 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 25 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 25 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 25 | CODE | |
| LOW | oauth2_provider/views/metadata.py | 16 | CODE | |
| LOW | oauth2_provider/views/metadata.py | 16 | CODE | |
| LOW | oauth2_provider/views/metadata.py | 16 | CODE | |
| LOW | oauth2_provider/views/metadata.py | 16 | CODE | |
| LOW | oauth2_provider/views/metadata.py | 16 | CODE | |
| LOW | oauth2_provider/views/metadata.py | 23 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 10 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 10 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 10 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 10 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 16 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 16 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 16 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 16 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 16 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 23 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 23 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 23 | CODE | |
| 28 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | pyproject.toml | 101 | [tool.pytest.ini_options] | COMMENT |
| LOW | tox.ini | 1 | [tox] | COMMENT |
| LOW | tox.ini | 241 | # Runs the OpenID Foundation conformance suite (the OpenID Provider certification | COMMENT |
| LOW | tox.ini | 261 | python tests/openid-conformance-suite/run.py {posargs} | COMMENT |
| LOW | docker-compose.yml | 21 | condition: service_completed_successfully | COMMENT |
| LOW | tests/app/idp/idp/settings.py | 361 | "CIMD_ENABLED": env("OAUTH2_PROVIDER_CIMD_ENABLED"), | COMMENT |
| LOW | tests/app/idp/idp/settings.py | 401 | # occasionally you may want to see what's going on in upstream in oauthlib | COMMENT |
| LOW | tests/app/rp/src/lib/oidc-config.js | 1 | import { env } from '$env/dynamic/public'; | COMMENT |
| LOW | docs/conf.py | 1 | # Django OAuth Toolkit documentation build configuration file, created by | COMMENT |
| LOW | docs/conf.py | 81 | # There are two options for replacing |today|: either, you set today to some | COMMENT |
| LOW | docs/conf.py | 121 | COMMENT | |
| LOW | docs/conf.py | 141 | # A shorter title for the navigation bar. Default is the same as html_title. | COMMENT |
| LOW | docs/conf.py | 161 | COMMENT | |
| LOW | docs/conf.py | 181 | COMMENT | |
| LOW | docs/conf.py | 221 | # the title page. | COMMENT |
| LOW | oauth2_provider/models.py | 561 | ) | COMMENT |
| LOW | oauth2_provider/models.py | 1841 | # refresh token when an access token is revoked -- so any that remain came from an | COMMENT |
| LOW | oauth2_provider/models.py | 2001 | # request smuggle "/cb;evil=1" past a registered "/cb". urlsplit() leaves the | COMMENT |
| LOW | oauth2_provider/models.py | 2061 | elif allowed_hostname != uri_hostname: | COMMENT |
| LOW | oauth2_provider/models.py | 2101 | # request carry query parameters that were never registered: an attacker | COMMENT |
| LOW | oauth2_provider/validators.py | 21 | (r"(?:" + URLValidator.host_re, URLValidator.ipv4_re, URLValidator.ipv6_re, dotless_domain_re + ")") | COMMENT |
| LOW | oauth2_provider/oauth2_validators.py | 821 | # First, to ensure we don't have concurrency issues, we refresh the refresh token | COMMENT |
| LOW | oauth2_provider/oauth2_validators.py | 981 | # non-rotating refresh leaves the existing row in place, so a duplicate points | COMMENT |
| LOW | oauth2_provider/oauth2_validators.py | 1121 | # as a deliberate revocation (the RFC 7009 /revoke/ endpoint, the admin, | COMMENT |
| LOW | oauth2_provider/oauth2_validators.py | 1141 | # Enforce REFRESH_TOKEN_EXPIRE_SECONDS at validation time. Historically the setting | COMMENT |
| LOW | oauth2_provider/settings.py | 41 | STORED_AUTHORIZATION_REQUEST_MODEL = getattr( | COMMENT |
| LOW | oauth2_provider/settings.py | 141 | # Whether or not PKCE is required | COMMENT |
| LOW | oauth2_provider/core/safe_fetch.py | 121 | # present userinfo component (and would leak the "@" into the Host header | COMMENT |
| LOW | …2_provider/management/commands/cleardcrapplications.py | 81 | # waits until this transaction ends — it can never be silently | COMMENT |
| LOW | …_provider/management/commands/clearcimdapplications.py | 41 | while True: | COMMENT |
| LOW | …provider/static/oauth2_provider/js/application_form.js | 1 | // Live client-secret UX for the Application form. | COMMENT |
| LOW | oauth2_provider/authorization_server/admin.py | 101 | # Access tokens are issued by the OAuth flows, not hand-created in the admin. | COMMENT |
| LOW | oauth2_provider/authorization_server/cimd.py | 61 | GRANT_TYPE_MAP = { | COMMENT |
| LOW | oauth2_provider/authorization_server/cimd.py | 481 | jwks = metadata.get("jwks") | COMMENT |
| LOW | …_provider/authorization_server/oidc/client_metadata.py | 21 | COMMENT | |
| LOW | oauth2_provider/authorization_server/oidc/views.py | 281 | # | COMMENT |
| LOW | …horization_server/views/dynamic_client_registration.py | 461 | return None, _error_response("invalid_client_metadata", "jwks_uri must use the https scheme") | COMMENT |
| LOW | …horization_server/views/dynamic_client_registration.py | 481 | "invalid_client_metadata", | COMMENT |
| LOW | oauth2_provider/authorization_server/views/base.py | 721 | # (OpenID Connect Core 1.0 section 3.1.2.1). Prompt Create 1.0 | COMMENT |
| LOW | oauth2_provider/authorization_server/views/base.py | 1261 | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_rfc8707_integration.py | 99 | # Step 3: Verify access token has resource binding (JSON array format) | COMMENT |
| LOW⚡ | tests/test_rfc8707_integration.py | 104 | # Step 4: Verify audience validation | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 47 | # Step 1: Authorization request with resource parameter | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 80 | # Step 2: Token request with resource parameter | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 403 | # Step 1: Authorization request with limited resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 418 | # Step 2: Token request trying to escalate to unauthorized resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 470 | # Step 1: Authorization with multiple resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 487 | # Step 2: Token request WITHOUT resource parameter | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 543 | # Step 1: Authorization with three resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 562 | # Step 2: Token request repeating the resource parameter to narrow to two | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 616 | # Step 1: Authorization with a single resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 630 | # Step 2: Token request repeating resource params, one outside the grant | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 681 | # Step 1: Authorization with resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 696 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 724 | # Step 3: Use refresh token to get new access token | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 739 | # Step 4: Verify new access token preserves resource from refresh token | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 775 | # Step 1: Authorization with specific resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 795 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 819 | # Step 3: Attempt refresh with unauthorized resource - should fail | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 837 | # Step 4: Get fresh token to test narrowing (previous refresh may have consumed token) | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 856 | # Step 5: Refresh with subset (resource1 only) - should succeed | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 905 | # Step 1: Authorization with resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 920 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 942 | # Step 3: Use refresh token (should rotate and create new refresh token) | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 996 | # Step 1: Authorization with resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 1010 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 1028 | # Step 3: Refresh (non-rotating — same refresh token reused, access token updated in place) | COMMENT |
| LOW⚡ | tests/e2e/browser_rp/test_browser_par.py | 25 | # Step 1: the RP server pushes the request (back channel) and returns a request_uri. | COMMENT |
| LOW⚡ | tests/e2e/browser_rp/test_browser_par.py | 30 | # Step 2: only client_id + request_uri travel through the browser to /authorize. | COMMENT |
| LOW | tests/e2e/browser_rp/test_browser_par.py | 43 | # Step 3: the RP server exchanged the code; the token response is displayed. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_rfc8707_integration.py | 99 | # Step 3: Verify access token has resource binding (JSON array format) | COMMENT |
| LOW⚡ | tests/test_rfc8707_integration.py | 104 | # Step 4: Verify audience validation | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 47 | # Step 1: Authorization request with resource parameter | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 80 | # Step 2: Token request with resource parameter | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 403 | # Step 1: Authorization request with limited resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 418 | # Step 2: Token request trying to escalate to unauthorized resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 470 | # Step 1: Authorization with multiple resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 487 | # Step 2: Token request WITHOUT resource parameter | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 543 | # Step 1: Authorization with three resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 562 | # Step 2: Token request repeating the resource parameter to narrow to two | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 616 | # Step 1: Authorization with a single resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 630 | # Step 2: Token request repeating resource params, one outside the grant | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 681 | # Step 1: Authorization with resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 696 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 724 | # Step 3: Use refresh token to get new access token | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 739 | # Step 4: Verify new access token preserves resource from refresh token | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 775 | # Step 1: Authorization with specific resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 795 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 819 | # Step 3: Attempt refresh with unauthorized resource - should fail | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 837 | # Step 4: Get fresh token to test narrowing (previous refresh may have consumed token) | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 856 | # Step 5: Refresh with subset (resource1 only) - should succeed | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 905 | # Step 1: Authorization with resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 920 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 942 | # Step 3: Use refresh token (should rotate and create new refresh token) | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 996 | # Step 1: Authorization with resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 1010 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 1028 | # Step 3: Refresh (non-rotating — same refresh token reused, access token updated in place) | COMMENT |
| LOW⚡ | tests/e2e/browser_rp/test_browser_par.py | 25 | # Step 1: the RP server pushes the request (back channel) and returns a request_uri. | COMMENT |
| LOW⚡ | tests/e2e/browser_rp/test_browser_par.py | 30 | # Step 2: only client_id + request_uri travel through the browser to /authorize. | COMMENT |
| LOW | tests/e2e/browser_rp/test_browser_par.py | 43 | # Step 3: the RP server exchanged the code; the token response is displayed. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_device.py | 1092 | except AttributeError: | CODE |
| HIGH | tests/openid-conformance-suite/run.py | 184 | except (urllib.error.URLError, OSError, ConnectionError): | CODE |
| HIGH | tests/e2e/helpers/idp_process.py | 227 | except requests.RequestException: | CODE |
| HIGH | tests/e2e/helpers/rp_process.py | 177 | except requests.RequestException: | CODE |
| HIGH | oauth2_provider/oauth2_validators.py | 846 | except (AccessToken.DoesNotExist, RefreshToken.DoesNotExist): | CODE |
| HIGH | …th2_provider/authorization_server/client_assertions.py | 302 | except ValueError: | CODE |
| HIGH | oauth2_provider/authorization_server/oidc/claims.py | 198 | except (TypeError, ValueError): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_application_views.py | 691 | cls.admin_user = UserModel.objects.create_superuser("admin_user", "admin@example.com", "123456") | CODE |
| LOW | tests/test_oidc_scope_claims.py | 227 | return {"email": "user@example.com", "nickname": "user", "custom": "value"} | CODE |
| LOW | tests/test_oidc_scope_claims.py | 279 | assert claims["email"] == "user@example.com" | CODE |
| LOW⚡ | tests/test_rest_framework.py | 187 | auth = self._create_authorization_header("fake-token") | CODE |
| LOW⚡ | tests/test_rest_framework.py | 207 | auth = self._create_authorization_header("fake-token") | CODE |
| LOW⚡ | tests/test_rest_framework.py | 236 | auth = self._create_authorization_header("fake-token") | CODE |
| LOW⚡ | tests/test_rest_framework.py | 262 | auth = self._create_authorization_header("fake-token") | CODE |
| LOW⚡ | tests/test_rest_framework.py | 278 | auth = self._create_authorization_header("fake-token") | CODE |
| LOW⚡ | tests/test_rest_framework.py | 471 | auth = self._create_authorization_header("fake-token") | CODE |
| LOW | tests/test_settings.py | 254 | admin_user = UserModel.objects.create_superuser("admin", "admin@example.com", "password") | CODE |
| LOW | rfcs/openid-connect-registration-1_0.txt | 757 | "contacts": ["ve7jtb@example.org", "mary@example.org"], | CODE |
| LOW | rfcs/openid-connect-registration-1_0.txt | 876 | "contacts": ["ve7jtb@example.org", "mary@example.org"], | CODE |
| LOW | rfcs/openid-connect-registration-1_0.txt | 1098 | "contacts": ["ve7jtb@example.org", "mary@example.org"], | CODE |
| LOW | rfcs/openid-connect-core-1_0.txt | 3371 | "name": "Jane Doe", | CODE |
| LOW | rfcs/openid-connect-core-1_0.txt | 3796 | "name": "Jane Doe", | CODE |
| LOW | rfcs/openid-connect-core-1_0.txt | 3936 | "name": "Jane Doe", | CODE |
| LOW | rfcs/openid-connect-core-1_0.txt | 3998 | "name": "Jane Doe", | CODE |
| LOW | rfcs/openid-connect-core-1_0.txt | 7742 | "name": "Jane Doe", | CODE |
| LOW | rfcs/openid-connect-discovery-1_0.txt | 650 | Such an example is "acct:joe%40example.com@example.org". End-Users | CODE |
| LOW | rfcs/openid-connect-discovery-1_0.txt | 651 | MAY input values like "joe@example.com@example.org" to initiate | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tox.ini | 251 | # The runner scripts the harness downloads from the suite need httpx and | COMMENT |
| MEDIUM⚡ | tests/test_admin.py | 182 | # request has none, so attach a permissive stub (no DB needed) to keep the assertion robust. | COMMENT |
| MEDIUM | tests/test_import_compat.py | 277 | # test asserts only on the subclass-time warning below (and stays robust if the | COMMENT |
| MEDIUM | tests/multi_db_settings.py | 15 | # Keep ``default`` concrete so Django's test harness can use standard multi-db | COMMENT |
| LOW | tests/test_device.py | 1087 | # values take effect without wiping the overrides we just set above. | COMMENT |
| MEDIUM | tests/app/idp/idp/settings.py | 395 | # log oauth2_provider issues to facilitate troubleshooting | COMMENT |
| LOW | tests/app/idp/idp/oauth.py | 11 | # the way we're using it, so we just use a lambda that returns None | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_introspection_view.py | 609 | CODE | |
| LOW | tests/test_import_compat.py | 21 | CODE | |
| LOW | tests/test_import_compat.py | 369 | CODE | |
| LOW | tests/test_import_compat.py | 415 | CODE | |
| LOW | tests/test_dcr_views.py | 308 | CODE | |
| LOW | tests/openid-conformance-suite/run.py | 173 | CODE | |
| LOW | tests/e2e/conftest.py | 80 | CODE | |
| LOW | tests/e2e/compliance.py | 109 | CODE | |
| LOW | oauth2_provider/models.py | 544 | CODE | |
| LOW | oauth2_provider/models.py | 719 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 176 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 242 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 281 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 545 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 677 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 761 | CODE | |
| LOW | oauth2_provider/settings.py | 490 | CODE | |
| LOW | oauth2_provider/core/checks.py | 404 | CODE | |
| LOW | …2_provider/management/commands/cleardcrapplications.py | 45 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/permissions.py | 152 | CODE | |
| LOW | …th2_provider/authorization_server/client_assertions.py | 194 | CODE | |
| LOW | …th2_provider/authorization_server/client_assertions.py | 271 | CODE | |
| LOW | oauth2_provider/authorization_server/oidc/claims.py | 40 | CODE | |
| LOW | oauth2_provider/authorization_server/views/base.py | 311 | CODE | |
| LOW | oauth2_provider/authorization_server/views/base.py | 699 | CODE | |
| LOW | oauth2_provider/authorization_server/views/base.py | 1340 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/browser_cross_site/conftest.py | 107 | except Exception as exc: # pragma: no cover - environment guard | CODE |
| LOW | tests/e2e/browser_cross_site/conftest.py | 135 | except Exception as exc: # pragma: no cover - environment guard | CODE |
| LOW | tests/e2e/browser_cross_site/conftest.py | 159 | except Exception as exc: # pragma: no cover - environment guard | CODE |
| LOW | …e2e/browser_cross_site/test_silent_login_cross_site.py | 73 | except Exception as exc: | CODE |
| LOW | tests/e2e/browser_rp/conftest.py | 45 | except Exception as exc: # pragma: no cover - environment guard | CODE |
| LOW | tests/e2e/browser_rp/conftest.py | 67 | except Exception as exc: # pragma: no cover - environment guard | CODE |
| LOW | tests/e2e/browser_rp/conftest.py | 80 | except Exception as exc: # pragma: no cover - environment guard | CODE |
| LOW | tests/e2e/helpers/browser.py | 47 | except Exception as exc: # Playwright TimeoutError (or the check's own AssertionError) | CODE |
| LOW | oauth2_provider/core/checks.py | 439 | except Exception: | CODE |
| LOW | …th2_provider/authorization_server/client_assertions.py | 315 | except Exception: | CODE |
| LOW⚡ | …th2_provider/authorization_server/client_assertions.py | 370 | except Exception: | CODE |
| LOW⚡ | …th2_provider/authorization_server/client_assertions.py | 383 | except Exception: | CODE |
| LOW | …th2_provider/authorization_server/client_assertions.py | 512 | except Exception: | CODE |
| LOW | …th2_provider/authorization_server/client_assertions.py | 647 | except Exception as exc: | CODE |
| LOW | oauth2_provider/authorization_server/cimd.py | 754 | except Exception: | CODE |
| LOW | …_provider/authorization_server/oidc/request_objects.py | 246 | except Exception as exc: | CODE |
| LOW | …_provider/authorization_server/oidc/request_objects.py | 393 | except Exception: | CODE |
| LOW | oauth2_provider/authorization_server/views/base.py | 350 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_oauth2_provider_middleware.py | 54 | # Create a valid access token | COMMENT |
| MEDIUM | tests/test_application_views.py | 46 | # Create a registration view and tests that the model form is bound | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 1369 | # Create a second application with its own token | COMMENT |
| MEDIUM | docs/conf.py | 4 | # This file is execfile()d with the current directory set to its containing dir. | COMMENT |
| MEDIUM | oauth2_provider/oauth2_validators.py | 878 | # Creating a fresh *access* token here would violate the OneToOne | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | oauth2_provider/models.py | 40 | logger = logging.getLogger(__name__) | CODE |
| LOW | oauth2_provider/models.py | 137 | def set_token_value(token_instance: "AbstractAccessToken | AbstractRefreshToken", raw_token: str) -> None: | CODE |
| LOW | oauth2_provider/oauth2_validators.py | 75 | __all__ = [ | CODE |
| LOW | oauth2_provider/core/compat.py | 15 | __all__ = ["login_not_required"] | CODE |
| LOW | oauth2_provider/core/utils.py | 145 | def set_oauthlib_user_to_device_request_user(request: Request) -> None: | CODE |
| LOW | oauth2_provider/resource_server/__init__.py | 50 | __all__ = ["build_bearer_challenge", "challenge_status", *sorted(_LAZY)] | CODE |
| LOW | oauth2_provider/contrib/ninja/__init__.py | 5 | __all__ = ["HttpOAuth2", "OAuth2ClientRateThrottle", "OAuth2UserOrClientRateThrottle"] | CODE |
| LOW | oauth2_provider/views/mixins.py | 36 | __all__ = [ | CODE |
| LOW | oauth2_provider/views/metadata.py | 26 | __all__ = [ | CODE |
| LOW | oauth2_provider/client/__init__.py | 22 | __all__ = ["make_client_assertion"] | CODE |
| LOW | oauth2_provider/client/client_assertions.py | 22 | __all__ = ["make_client_assertion"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | oauth2_provider/settings.py | 494 | # Check if present in user settings | COMMENT |
| LOW | oauth2_provider/resource_server/decorators.py | 121 | # Check if provided scopes are acceptable | COMMENT |
| LOW | oauth2_provider/resource_server/decorators.py | 131 | # Check if method is safe. Build a fresh list per request so the read/write | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/helpers/oauth_client.py | 147 | CODE | |
| LOW | tests/e2e/helpers/oauth_client.py | 184 | CODE | |
| LOW | tests/e2e/helpers/idp_process.py | 67 | CODE | |
| LOW | oauth2_provider/resource_server/middleware.py | 65 | CODE |