OAuth2 goodies for the Djangonauts!
This report presents the forensic synthetic code analysis of django-oauth/django-oauth-toolkit, a Python project with 3,334 GitHub stars. SynthScan v2.0 examined 104,166 lines of code across 336 source files, recording 1647 pattern matches distributed across 17 syntactic categories. The overall adjusted score of 20.9 places this repository in the Moderate AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1647 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_www_authenticate.py | 24 | def test_bare_bearer_when_nothing_to_advertise(self): | CODE |
| LOW | tests/test_www_authenticate.py | 28 | def test_includes_error_and_resource_metadata(self): | CODE |
| LOW⚡ | tests/test_www_authenticate.py | 42 | def test_explicit_resource_metadata_url_overrides_default(self): | CODE |
| LOW⚡ | tests/test_www_authenticate.py | 50 | def test_explicit_none_omits_resource_metadata(self): | CODE |
| LOW⚡ | tests/test_www_authenticate.py | 55 | def test_quoted_string_values_are_escaped(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 32 | def test_malformed_bearer_header_no_token(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 42 | def test_malformed_bearer_header_empty_token(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 74 | def test_invalid_bearer_token(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 84 | def test_invalid_bearer_token_logs_at_debug_level(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 98 | def test_no_authorization_header(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 107 | def test_non_bearer_authorization_header(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 127 | def test_case_insensitive_bearer_scheme(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 140 | def test_scheme_starting_with_bearer_is_rejected(self): | CODE |
| LOW | tests/test_oauth2_provider_middleware.py | 150 | def test_whitespace_variations(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 69 | def test_json_body_keeps_legacy_error(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 82 | def test_multipart_body_is_accepted(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 88 | def test_non_compliant_body_warns_about_the_coming_default(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 101 | def test_compliant_body_does_not_warn(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 112 | def test_get_request_does_not_warn(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 134 | def test_form_encoded_body_is_accepted(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 141 | def test_charset_parameter_is_accepted(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 150 | def test_json_body_is_rejected(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 162 | def test_multipart_body_is_rejected(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 168 | def test_missing_content_type_is_rejected(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 174 | def test_every_form_encoded_endpoint_is_covered(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 184 | def test_get_requests_are_unaffected(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 196 | def test_disabled_endpoint_still_reports_not_found(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 214 | def test_json_registration_still_succeeds(self): | CODE |
| LOW | tests/test_form_encoded_requests.py | 239 | def test_userinfo_post_is_not_rejected(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 254 | def test_no_error_when_only_the_gate_is_set(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 259 | def test_no_error_when_only_the_json_backend_is_set(self): | CODE |
| LOW⚡ | tests/test_form_encoded_requests.py | 264 | def test_error_when_the_json_backend_can_never_be_reached(self): | CODE |
| LOW | tests/test_admin.py | 61 | def test_mask_credential_hides_the_secret(): | CODE |
| LOW | tests/test_admin.py | 80 | def _assert_hidden_on_change_form(admin_class, model, field, masked_field): | CODE |
| LOW | tests/test_admin.py | 94 | def test_credential_admins_disable_add(): | CODE |
| LOW | tests/test_admin.py | 107 | def test_admin_overrides_preserve_subclass_config(): | CODE |
| LOW⚡ | tests/test_admin.py | 128 | def _assert_searchable_by_app_and_user(admin_class): | CODE |
| LOW⚡ | tests/test_admin.py | 136 | def test_access_token_admin_does_not_expose_token(): | CODE |
| LOW⚡ | tests/test_admin.py | 143 | def test_refresh_token_admin_does_not_expose_token(): | CODE |
| LOW⚡ | tests/test_admin.py | 150 | def test_grant_admin_does_not_expose_code(): | CODE |
| LOW⚡ | tests/test_admin.py | 157 | def test_par_admin_does_not_expose_request_uri(): | CODE |
| LOW⚡ | tests/test_admin.py | 166 | def test_id_token_admin_searchable_by_app_and_user(): | CODE |
| LOW⚡ | tests/test_admin.py | 172 | def test_credential_admins_delete_policy(): | CODE |
| LOW | tests/test_admin.py | 214 | def test_access_token_admin_revoke_action_revokes_token_family(): | CODE |
| LOW | tests/test_admin.py | 238 | def test_access_token_admin_revoke_action_without_refresh_token_deletes(): | CODE |
| LOW | tests/test_admin.py | 255 | def test_refresh_token_admin_revoke_action_revokes_token_family(): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 140 | def test_authenticate_basic_auth_hashed_secret(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 145 | def test_authenticate_basic_auth_unhashed_secret(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 154 | def test_authenticate_basic_auth_default_encoding(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 159 | def test_authenticate_basic_auth_wrong_client_id(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 164 | def test_authenticate_basic_auth_wrong_client_secret(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 169 | def test_authenticate_basic_auth_wrong_client_secret_not_logged(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 177 | def test_authenticate_request_body_wrong_client_secret_not_logged(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 185 | def test_authenticate_basic_auth_undecodable_credentials_not_logged(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 227 | def test_authenticate_basic_auth_public_app_with_device_code(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 233 | def test_authenticate_check_secret(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 240 | def test_authenticate_client_id(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 243 | def test_authenticate_client_id_fail(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 249 | def test_client_authentication_required(self): | CODE |
| LOW⚡ | tests/test_oauth2_validators.py | 263 | def test_load_application_loads_client_id_when_request_has_no_client(self): | CODE |
| 1189 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | tests/test_bcp_rfc9700.py | 76 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_bcp_rfc9700.py | 78 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_bcp_rfc9700.py | 246 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_bcp_rfc9700.py | 248 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_bcp_rfc9700.py | 562 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_bcp_rfc9700.py | 564 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 41 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 43 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 121 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 123 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 202 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 204 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 421 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_bcp_rfc9700.py | 423 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_device.py | 256 | # -------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_device.py | 258 | # -------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_device.py | 268 | # ------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_device.py | 270 | # ------------------------- | COMMENT |
| MEDIUM | tests/test_device.py | 139 | # ----------------------- | COMMENT |
| MEDIUM | tests/test_device.py | 142 | # ----------------------- | COMMENT |
| MEDIUM | tests/test_device.py | 197 | # -------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_device.py | 200 | # -------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_device.py | 242 | # -------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_device.py | 245 | # -------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_dcr_views.py | 347 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_dcr_views.py | 349 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_dcr_views.py | 450 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_dcr_views.py | 452 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_dcr_views.py | 784 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_dcr_views.py | 786 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 23 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 25 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 49 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 51 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 374 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 377 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 883 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 885 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 909 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 911 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 969 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 971 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 1048 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 1050 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 169 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 171 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 251 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 253 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 292 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 294 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 308 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 310 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 408 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 410 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 543 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 545 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 582 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 584 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 787 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/test_cimd.py | 789 | # --------------------------------------------------------------------------- | COMMENT |
| 34 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_implicit.py | 0 | test for default redirect uri if omitted from query string with response_type: code | STRING |
| HIGH | tests/test_authorization_code.py | 0 | test for default redirect uri if omitted from query string with response_type: code | STRING |
| HIGH | tests/test_hybrid.py | 0 | test for default redirect uri if omitted from query string with response_type: code | STRING |
| HIGH | tests/test_implicit.py | 0 | test error when passing a forbidden redirect_uri in query string with response_type: code | STRING |
| HIGH | tests/test_authorization_code.py | 0 | test error when passing a forbidden redirect_uri in query string with response_type: code | STRING |
| HIGH | tests/test_hybrid.py | 0 | test error when passing a forbidden redirect_uri in query string with response_type: code | STRING |
| HIGH | tests/test_implicit.py | 0 | test authorization code is given for an allowed request with response_type: code | STRING |
| HIGH | tests/test_authorization_code.py | 0 | test authorization code is given for an allowed request with response_type: code | STRING |
| HIGH | tests/test_hybrid.py | 0 | test authorization code is given for an allowed request with response_type: code | STRING |
| HIGH | tests/test_implicit.py | 0 | if application.skip_authorization = true, should skip the authorization page. | STRING |
| HIGH | tests/test_authorization_code.py | 0 | if application.skip_authorization = true, should skip the authorization page. | STRING |
| HIGH | tests/test_hybrid.py | 0 | if application.skip_authorization = true, should skip the authorization page. | STRING |
| HIGH | tests/test_implicit.py | 0 | tests that a redirection uri with query string is allowed and query string is retained on redirection. see https://rfc-e | STRING |
| HIGH | tests/test_authorization_code.py | 0 | tests that a redirection uri with query string is allowed and query string is retained on redirection. see https://rfc-e | STRING |
| HIGH | tests/test_hybrid.py | 0 | tests that a redirection uri with query string is allowed and query string is retained on redirection. see https://rfc-e | STRING |
| HIGH | tests/test_implicit.py | 0 | tests that a redirection uri is matched using scheme + netloc + path | STRING |
| HIGH | tests/test_authorization_code.py | 0 | tests that a redirection uri is matched using scheme + netloc + path | STRING |
| HIGH | tests/test_hybrid.py | 0 | tests that a redirection uri is matched using scheme + netloc + path | STRING |
| HIGH | oauth2_provider/scopes.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/signals.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/compat.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/oauth2_backends.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/checks.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/bcp.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/forms.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/backends.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/utils.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/http.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/exceptions.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/cimd.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/www_authenticate.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/middleware.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/dcr.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/decorators.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/oidc.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/token.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/device.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/generic.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/dynamic_client_registration.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/introspect.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/application.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/views/base.py | 0 | backward-compatible import shim. ``oauth2_provider.views.base`` has moved to ``oauth2_provider.authorization_server.view | STRING |
| HIGH | oauth2_provider/core/backends_oauthlib.py | 0 | a wrapper method that calls create_userinfo_response on the `server_class` instance. :param request: the current django. | STRING |
| HIGH | oauth2_provider/authorization_server/views/mixins.py | 0 | a wrapper method that calls create_userinfo_response on the `server_class` instance. :param request: the current django. | STRING |
| HIGH | oauth2_provider/resource_server/mixins.py | 0 | a wrapper method that calls create_userinfo_response on the `server_class` instance. :param request: the current django. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | tests/test_oauth2_validators.py | 18 | from oauth2_provider.core.exceptions import FatalClientError | CODE |
| CRITICAL⚡ | tests/test_dcr_views.py | 338 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL⚡ | tests/test_resource_validators.py | 436 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL⚡ | tests/test_resource_validators.py | 442 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/models.py | 426 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/validators.py | 5 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/core/backends_oauthlib.py | 13 | from oauth2_provider.core.exceptions import FatalClientError, OAuthToolkitError | CODE |
| CRITICAL | …uth2_provider/management/commands/createapplication.py | 1 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/authorization_server/cimd.py | 28 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/authorization_server/views/mixins.py | 11 | from oauth2_provider.core.exceptions import FatalClientError | CODE |
| CRITICAL | oauth2_provider/authorization_server/views/device.py | 5 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | …horization_server/views/dynamic_client_registration.py | 17 | from django.core.exceptions import ValidationError | CODE |
| CRITICAL | oauth2_provider/authorization_server/views/par.py | 10 | from oauth2_provider.core.exceptions import OAuthToolkitError | CODE |
| CRITICAL | oauth2_provider/authorization_server/views/base.py | 25 | from oauth2_provider.core.exceptions import FatalClientError, OAuthToolkitError | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/mysql_settings.py | 5 | CODE | |
| LOW | tests/settings_swapped.py | 1 | CODE | |
| LOW | tests/test_import_compat.py | 236 | CODE | |
| LOW | tests/test_import_compat.py | 237 | CODE | |
| LOW | tests/multi_db_settings.py | 3 | CODE | |
| LOW | tests/mysql_pr_settings.py | 5 | CODE | |
| LOW | tests/multi_db_settings_invalid_token_configuration.py | 1 | CODE | |
| LOW | tests/postgres_pr_settings.py | 3 | CODE | |
| LOW | tests/postgres_settings.py | 3 | CODE | |
| LOW | oauth2_provider/models.py | 37 | CODE | |
| LOW | oauth2_provider/validators.py | 13 | CODE | |
| LOW | oauth2_provider/apps.py | 10 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 51 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 51 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 51 | CODE | |
| LOW | oauth2_provider/core/compat.py | 8 | CODE | |
| LOW | oauth2_provider/resource_server/__init__.py | 14 | CODE | |
| LOW | oauth2_provider/resource_server/__init__.py | 14 | CODE | |
| LOW | oauth2_provider/contrib/ninja/__init__.py | 1 | CODE | |
| LOW | oauth2_provider/contrib/ninja/__init__.py | 2 | CODE | |
| LOW | oauth2_provider/contrib/ninja/__init__.py | 2 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 2 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 2 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 3 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 3 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 3 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 3 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 3 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 10 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/__init__.py | 10 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 19 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 19 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 24 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 25 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 25 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 25 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 25 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 25 | CODE | |
| LOW | oauth2_provider/views/mixins.py | 25 | CODE | |
| LOW | oauth2_provider/views/metadata.py | 16 | CODE | |
| LOW | oauth2_provider/views/metadata.py | 16 | CODE | |
| LOW | oauth2_provider/views/metadata.py | 16 | CODE | |
| LOW | oauth2_provider/views/metadata.py | 16 | CODE | |
| LOW | oauth2_provider/views/metadata.py | 16 | CODE | |
| LOW | oauth2_provider/views/metadata.py | 23 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 10 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 10 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 10 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 10 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 16 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 16 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 16 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 16 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 16 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 23 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 23 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 23 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 24 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 24 | CODE | |
| LOW | oauth2_provider/views/__init__.py | 24 | CODE | |
| 21 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | tests/test_oidc_views.py | 183 | """Required OIDC endpoints must fail fast, not emit null, when unreversible.""" | STRING |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 108 | response = self.push(extra={"request_uri": f"{REQUEST_URI_PREFIX}abc"}) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 113 | response = self.push(extra={"request": "eyJ.abc.def"}) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 150 | response = self.push(auth=False) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 189 | response = self.push(extra={"redirect_uri": "http://not-registered.example"}) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 194 | response = self.push(extra={"client_id": self.public_application.client_id}) | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 201 | response = self.push() | CODE |
| HIGH⚡ | tests/test_pushed_authorization_request.py | 434 | push = self.push() | CODE |
| HIGH | tests/test_pushed_authorization_request.py | 90 | response = self.push() | CODE |
| HIGH | tests/test_pushed_authorization_request.py | 265 | response = self.push( | CODE |
| HIGH | tests/test_pushed_authorization_request.py | 294 | push = self.push() | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_rfc8707_integration.py | 96 | # Step 3: Verify access token has resource binding (JSON array format) | COMMENT |
| LOW⚡ | tests/test_rfc8707_integration.py | 101 | # Step 4: Verify audience validation | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 45 | # Step 1: Authorization request with resource parameter | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 78 | # Step 2: Token request with resource parameter | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 396 | # Step 1: Authorization request with limited resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 411 | # Step 2: Token request trying to escalate to unauthorized resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 462 | # Step 1: Authorization with multiple resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 479 | # Step 2: Token request WITHOUT resource parameter | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 534 | # Step 1: Authorization with three resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 553 | # Step 2: Token request repeating the resource parameter to narrow to two | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 606 | # Step 1: Authorization with a single resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 620 | # Step 2: Token request repeating resource params, one outside the grant | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 670 | # Step 1: Authorization with resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 685 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 712 | # Step 3: Use refresh token to get new access token | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 726 | # Step 4: Verify new access token preserves resource from refresh token | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 762 | # Step 1: Authorization with specific resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 782 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 805 | # Step 3: Attempt refresh with unauthorized resource - should fail | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 822 | # Step 4: Get fresh token to test narrowing (previous refresh may have consumed token) | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 840 | # Step 5: Refresh with subset (resource1 only) - should succeed | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 888 | # Step 1: Authorization with resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 903 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 924 | # Step 3: Use refresh token (should rotate and create new refresh token) | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 977 | # Step 1: Authorization with resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 991 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 1008 | # Step 3: Refresh (non-rotating — same refresh token reused, access token updated in place) | COMMENT |
| LOW⚡ | tests/e2e/browser_rp/test_browser_par.py | 25 | # Step 1: the RP server pushes the request (back channel) and returns a request_uri. | COMMENT |
| LOW⚡ | tests/e2e/browser_rp/test_browser_par.py | 30 | # Step 2: only client_id + request_uri travel through the browser to /authorize. | COMMENT |
| LOW | tests/e2e/browser_rp/test_browser_par.py | 43 | # Step 3: the RP server exchanged the code; the token response is displayed. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tests/test_rfc8707_integration.py | 96 | # Step 3: Verify access token has resource binding (JSON array format) | COMMENT |
| LOW⚡ | tests/test_rfc8707_integration.py | 101 | # Step 4: Verify audience validation | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 45 | # Step 1: Authorization request with resource parameter | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 78 | # Step 2: Token request with resource parameter | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 396 | # Step 1: Authorization request with limited resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 411 | # Step 2: Token request trying to escalate to unauthorized resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 462 | # Step 1: Authorization with multiple resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 479 | # Step 2: Token request WITHOUT resource parameter | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 534 | # Step 1: Authorization with three resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 553 | # Step 2: Token request repeating the resource parameter to narrow to two | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 606 | # Step 1: Authorization with a single resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 620 | # Step 2: Token request repeating resource params, one outside the grant | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 670 | # Step 1: Authorization with resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 685 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 712 | # Step 3: Use refresh token to get new access token | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 726 | # Step 4: Verify new access token preserves resource from refresh token | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 762 | # Step 1: Authorization with specific resources | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 782 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 805 | # Step 3: Attempt refresh with unauthorized resource - should fail | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 822 | # Step 4: Get fresh token to test narrowing (previous refresh may have consumed token) | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 840 | # Step 5: Refresh with subset (resource1 only) - should succeed | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 888 | # Step 1: Authorization with resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 903 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 924 | # Step 3: Use refresh token (should rotate and create new refresh token) | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 977 | # Step 1: Authorization with resource | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 991 | # Step 2: Exchange code for tokens | COMMENT |
| LOW | tests/test_rfc8707_integration.py | 1008 | # Step 3: Refresh (non-rotating — same refresh token reused, access token updated in place) | COMMENT |
| LOW⚡ | tests/e2e/browser_rp/test_browser_par.py | 25 | # Step 1: the RP server pushes the request (back channel) and returns a request_uri. | COMMENT |
| LOW⚡ | tests/e2e/browser_rp/test_browser_par.py | 30 | # Step 2: only client_id + request_uri travel through the browser to /authorize. | COMMENT |
| LOW | tests/e2e/browser_rp/test_browser_par.py | 43 | # Step 3: the RP server exchanged the code; the token response is displayed. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | pyproject.toml | 101 | [tool.pytest.ini_options] | COMMENT |
| LOW | tox.ini | 1 | [tox] | COMMENT |
| LOW | tox.ini | 221 | # registrable domains over TLS, in both Chromium and Firefox, to pin how | COMMENT |
| LOW | docker-compose.yml | 21 | condition: service_completed_successfully | COMMENT |
| LOW | tests/app/rp/src/lib/oidc-config.js | 1 | import { env } from '$env/dynamic/public'; | COMMENT |
| LOW | docs/conf.py | 1 | # Django OAuth Toolkit documentation build configuration file, created by | COMMENT |
| LOW | docs/conf.py | 81 | # There are two options for replacing |today|: either, you set today to some | COMMENT |
| LOW | docs/conf.py | 121 | COMMENT | |
| LOW | docs/conf.py | 141 | # A shorter title for the navigation bar. Default is the same as html_title. | COMMENT |
| LOW | docs/conf.py | 161 | COMMENT | |
| LOW | docs/conf.py | 181 | COMMENT | |
| LOW | docs/conf.py | 221 | # the title page. | COMMENT |
| LOW | oauth2_provider/models.py | 1781 | COMMENT | |
| LOW | oauth2_provider/validators.py | 21 | (r"(?:" + URLValidator.host_re, URLValidator.ipv4_re, URLValidator.ipv6_re, dotless_domain_re + ")") | COMMENT |
| LOW | oauth2_provider/oauth2_validators.py | 781 | COMMENT | |
| LOW | oauth2_provider/oauth2_validators.py | 1021 | u = None | COMMENT |
| LOW | oauth2_provider/oauth2_validators.py | 1061 | rt = RefreshToken.objects.filter(token_checksum=token_checksum).select_related("access_token").first() | COMMENT |
| LOW | oauth2_provider/oauth2_validators.py | 1081 | # rotated chain, whose access token a later rotation has since revoked | COMMENT |
| LOW | oauth2_provider/settings.py | 41 | PAR_REQUEST_MODEL = getattr( | COMMENT |
| LOW | oauth2_provider/settings.py | 141 | # device authorization and PAR) reject a POST sent with any other media type, with | COMMENT |
| LOW | …_provider/management/commands/clearcimdapplications.py | 41 | while True: | COMMENT |
| LOW | …provider/static/oauth2_provider/js/application_form.js | 1 | // Live client-secret UX for the Application form. | COMMENT |
| LOW | oauth2_provider/authorization_server/oidc/views.py | 241 | # Assumption: the `sub` claim and `user` property of the corresponding IDToken Object point to the | COMMENT |
| LOW | oauth2_provider/authorization_server/views/base.py | 481 | """ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | tests/test_admin.py | 178 | # request has none, so attach a permissive stub (no DB needed) to keep the assertion robust. | COMMENT |
| MEDIUM | tests/test_import_compat.py | 196 | # test asserts only on the subclass-time warning below (and stays robust if the | COMMENT |
| MEDIUM | tests/multi_db_settings.py | 15 | # Keep ``default`` concrete so Django's test harness can use standard multi-db | COMMENT |
| LOW | tests/test_device.py | 1087 | # values take effect without wiping the overrides we just set above. | COMMENT |
| MEDIUM | tests/app/idp/idp/settings.py | 346 | # log oauth2_provider issues to facilitate troubleshooting | COMMENT |
| LOW | tests/app/idp/idp/oauth.py | 11 | # the way we're using it, so we just use a lambda that returns None | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_application_views.py | 541 | cls.admin_user = UserModel.objects.create_superuser("admin_user", "admin@example.com", "123456") | CODE |
| LOW⚡ | tests/test_rest_framework.py | 187 | auth = self._create_authorization_header("fake-token") | CODE |
| LOW⚡ | tests/test_rest_framework.py | 207 | auth = self._create_authorization_header("fake-token") | CODE |
| LOW⚡ | tests/test_rest_framework.py | 236 | auth = self._create_authorization_header("fake-token") | CODE |
| LOW⚡ | tests/test_rest_framework.py | 262 | auth = self._create_authorization_header("fake-token") | CODE |
| LOW⚡ | tests/test_rest_framework.py | 278 | auth = self._create_authorization_header("fake-token") | CODE |
| LOW⚡ | tests/test_rest_framework.py | 471 | auth = self._create_authorization_header("fake-token") | CODE |
| LOW | tests/test_settings.py | 235 | admin_user = UserModel.objects.create_superuser("admin", "admin@example.com", "password") | CODE |
| LOW | rfcs/openid-connect-core-1_0.txt | 3371 | "name": "Jane Doe", | CODE |
| LOW | rfcs/openid-connect-core-1_0.txt | 3796 | "name": "Jane Doe", | CODE |
| LOW | rfcs/openid-connect-core-1_0.txt | 3936 | "name": "Jane Doe", | CODE |
| LOW | rfcs/openid-connect-core-1_0.txt | 3998 | "name": "Jane Doe", | CODE |
| LOW | rfcs/openid-connect-core-1_0.txt | 7742 | "name": "Jane Doe", | CODE |
| LOW | rfcs/openid-connect-discovery-1_0.txt | 650 | Such an example is "acct:joe%40example.com@example.org". End-Users | CODE |
| LOW | rfcs/openid-connect-discovery-1_0.txt | 651 | MAY input values like "joe@example.com@example.org" to initiate | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_oauth2_provider_middleware.py | 54 | # Create a valid access token | COMMENT |
| MEDIUM | tests/test_application_views.py | 35 | # Create a registration view and tests that the model form is bound | COMMENT |
| MEDIUM | tests/test_dcr_views.py | 622 | # Create a second application with its own token | COMMENT |
| MEDIUM | docs/conf.py | 4 | # This file is execfile()d with the current directory set to its containing dir. | COMMENT |
| MEDIUM | oauth2_provider/oauth2_validators.py | 842 | # Creating a fresh *access* token here would violate the OneToOne | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_import_compat.py | 277 | CODE | |
| LOW | tests/test_import_compat.py | 323 | CODE | |
| LOW | tests/e2e/conftest.py | 78 | CODE | |
| LOW | tests/e2e/compliance.py | 109 | CODE | |
| LOW | oauth2_provider/models.py | 519 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 160 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 226 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 265 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 525 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 642 | CODE | |
| LOW | oauth2_provider/oauth2_validators.py | 726 | CODE | |
| LOW | oauth2_provider/settings.py | 445 | CODE | |
| LOW | oauth2_provider/contrib/rest_framework/permissions.py | 152 | CODE | |
| LOW | oauth2_provider/authorization_server/views/base.py | 230 | CODE | |
| LOW | oauth2_provider/authorization_server/views/base.py | 570 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | oauth2_provider/models.py | 40 | logger = logging.getLogger(__name__) | CODE |
| LOW | oauth2_provider/models.py | 109 | def set_token_value(token_instance: "AbstractAccessToken | AbstractRefreshToken", raw_token: str) -> None: | CODE |
| LOW | oauth2_provider/oauth2_validators.py | 65 | __all__ = [ | CODE |
| LOW | oauth2_provider/core/compat.py | 15 | __all__ = ["login_not_required"] | CODE |
| LOW | oauth2_provider/core/utils.py | 122 | def set_oauthlib_user_to_device_request_user(request: Request) -> None: | CODE |
| LOW | oauth2_provider/resource_server/__init__.py | 50 | __all__ = ["build_bearer_challenge", "challenge_status", *sorted(_LAZY)] | CODE |
| LOW | oauth2_provider/contrib/ninja/__init__.py | 5 | __all__ = ["HttpOAuth2", "OAuth2ClientRateThrottle", "OAuth2UserOrClientRateThrottle"] | CODE |
| LOW | oauth2_provider/views/mixins.py | 36 | __all__ = [ | CODE |
| LOW | oauth2_provider/views/metadata.py | 26 | __all__ = [ | CODE |
| LOW | oauth2_provider/client/__init__.py | 22 | __all__ = ["make_client_assertion"] | CODE |
| LOW | oauth2_provider/client/client_assertions.py | 22 | __all__ = ["make_client_assertion"] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/browser_cross_site/conftest.py | 107 | except Exception as exc: # pragma: no cover - environment guard | CODE |
| LOW | tests/e2e/browser_cross_site/conftest.py | 135 | except Exception as exc: # pragma: no cover - environment guard | CODE |
| LOW | tests/e2e/browser_cross_site/conftest.py | 159 | except Exception as exc: # pragma: no cover - environment guard | CODE |
| LOW | …e2e/browser_cross_site/test_silent_login_cross_site.py | 73 | except Exception as exc: | CODE |
| LOW | tests/e2e/browser_rp/conftest.py | 45 | except Exception as exc: # pragma: no cover - environment guard | CODE |
| LOW | tests/e2e/browser_rp/conftest.py | 67 | except Exception as exc: # pragma: no cover - environment guard | CODE |
| LOW | tests/e2e/browser_rp/conftest.py | 80 | except Exception as exc: # pragma: no cover - environment guard | CODE |
| LOW | tests/e2e/helpers/browser.py | 47 | except Exception as exc: # Playwright TimeoutError (or the check's own AssertionError) | CODE |
| LOW | …th2_provider/authorization_server/client_assertions.py | 277 | except Exception: | CODE |
| LOW | oauth2_provider/authorization_server/cimd.py | 425 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | oauth2_provider/settings.py | 449 | # Check if present in user settings | COMMENT |
| LOW | oauth2_provider/resource_server/decorators.py | 121 | # Check if provided scopes are acceptable | COMMENT |
| LOW | oauth2_provider/resource_server/decorators.py | 131 | # Check if method is safe. Build a fresh list per request so the read/write | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/helpers/oauth_client.py | 147 | CODE | |
| LOW | tests/e2e/helpers/oauth_client.py | 184 | CODE | |
| LOW | tests/e2e/helpers/idp_process.py | 67 | CODE | |
| LOW | oauth2_provider/resource_server/middleware.py | 65 | CODE |