Gotcha in PersistedGrantFilter validation extension?

[stewart-ritchie]

It's possible to initialize the ClientIds and Types properties of the PersistedGrantFilter objects with empty collections, rather than null values.

In this scenario the validation does not capture that there are still no filters set, which feels like a bug waiting to happen.

https://github.com/DuendeSoftware/IdentityServer/blob/aff8930ebdcbcb3e2a4c8713a3fdf88712c757de/src/Storage/Extensions/PersistedGrantFilterExtensions.cs#L19-L32

[josephdecock]

Thanks for bringing this up. We'll investigate and follow up with our thoughts.

[RolandGuijt]

I've created an issue for this. Thanks for bringing this to our attention.