fix(jans-auth-server): when obtain new token using refresh token, che…

…ck whether scope is null (#3382)
JanssenProject · Dec 22, 2022 · 22743d9 · 22743d9
1 parent 3028a94
commit 22743d9
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/...-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenExchangeService.java b/...-auth-server/server/src/main/java/io/jans/as/server/token/ws/rs/TokenExchangeService.java
@@ -66,7 +66,8 @@ public class TokenExchangeService {
     private AttributeService attributeService;
 
     public void rotateDeviceSecretOnRefreshToken(HttpServletRequest httpRequest, AuthorizationGrant refreshGrant, String scope) {
-        if (!scope.contains(ScopeConstants.DEVICE_SSO)) {
+        if (StringUtils.isBlank(scope) || !scope.contains(ScopeConstants.DEVICE_SSO)) {
+            log.debug("Skip rotate device secret on refresh token. No device_sso scope.");
             return;
         }
         if (StringUtils.isBlank(refreshGrant.getSessionDn())) {