Absence of GET param seems to break Mintoken

[sebsel]

I am opening this on behalf of Richard, who was at IndieWebCamp Düsseldorf this weekend. This is also the context: we didn't get Mintoken to work and we had minus 3 minutes until demo time.

The endpoint seemed to crash on an error: array_merge() doesn't accept null as a second argument. This means that in the code below, filter_input_array(INPUT_GET, ['me' ...]) does return null. (Line 278)

php-mintoken/endpoint.php

Lines 265 to 281 in 5f508fb

	$request = array_merge(
	filter_input_array(INPUT_POST, [
	'grant_type' => [
	'filter' => FILTER_VALIDATE_REGEXP,
	'options' => ['regexp' => '@^authorization_code$@'],
	],
	'code' => [
	'filter' => FILTER_VALIDATE_REGEXP,
	'options' => ['regexp' => '@^[\x20-\x7E]+$@'],
	],
	'client_id' => FILTER_VALIDATE_URL,
	'redirect_uri' => FILTER_VALIDATE_URL,
	]),
	filter_input_array(INPUT_GET, [
	'me' => FILTER_VALIDATE_URL,
	])
	);

I cannot find a mention in the spec of the me param in either the POST-body nor the query string for the token request. But: Gimme-a-token does add the me, just in the POST-body, not the query string (which I think is the INPUT_GET but I am not sure how that works).

When we added a ?me= to the endpoint URL manually, it didn't seem to work either, but that's about all the debug-time we had left.

Can you shine any light on this? Where did me come from and why does Mintoken think it should come from GET?

[Zegnat]

The Mintoken design is old in IndieAuth terms. It is from before 2020. You would have to go back to at least January 2020 to find the latest spec that still included a me parameter on the § 6.3.1 Token Request. This is because later versions of IndieAuth dropped the me parameter. This was done when the entire communication channel between authorization and token endpoint was scrapped from the spec.

Because Mintoken does not come with an authorization endpoint at all, it is up to the user to make sure that their chosen authorization endpoint still uses the early-2020 way of communicating and that applications that come to get a token do the same.

For history:

1. Discussions on GitHub:
   • Allow the 'me' parameter to authorization endpoints to be omitted? indieweb/indieauth#19
   • Drop specification for communication between authorization and token endpoints. indieweb/indieauth#44
2. PR that did the work: Initial updates from IndieAuth popup session indieweb/indieauth#49
   • Specific commit that documents the out of scope: indieweb/indieauth@28c414c
3. Discussion note from the 2020-08-08 IndieAuth Pop-up

Hope that shines enough light on things! 😎