refresh token request results in 500 Internal Server Error

[poef]

When calling the token endpoint with this request:

POST https://solid-nextcloud.muze.nl/apps/solid/token
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
DPoP: ....
Origin: https://localhost/

grant_type=refresh_token&client_id=86a9106ae65537651a8e456835b316ab&client_secret=eaf6353d1af8487c9cc20e475ed48553&scope=openid&refresh_token=def50200640df38cd5a177acd2143f064585d9156382d21e5c4f473fea35465f6fcbc6ca3e0224f68e23a7a6ec4d4d5bdc7a5749c85209704cee09223319574442a2d4667baa607761d1af4c66ff4e9eb97266a5104c7904702b865364522313cd6a6a043f2c6e1dedfe08eb9c2aba53d58feca6b714f600445cfe34371dafe3fe8dc4f843f8f2b804b54611fb55555192252903118e2e49af4ef136c7681ab718c2853079298c5d9efb0969d28b0b7233411f480bfa0ce793d2c82f97f90e81275b81c19d37f75b5c9c0a036033fcaf31eed0b390ea4e0684fa93bf233acf2c02dbb5ca5cd62aa394e10dc0c304ce45d04361df1fa22d10b01286a6422a55a20612a37039831851f18494537176f1989f1c3542693800e176e3d3766943b46e027d0ece57cad1e9858954d10c7394c23cb916c3b7b58ba9154648c26dd077b751433a7f08e66ab6b4ba8a7994123d375c28a30c1340154d41554fe31ea95aeda64b0dcfaefab127537507618e5d5421cf419050a958be24b7e77babe990835ef77920ff6debc8ca6b83cb0f730e7eefec66fc1410e906a926b08ae29c82fd75b2b0423b99a4ff38845ca4c53f6dffa6b69ba9f6f7b385c109050859f1baf280a6ec565afa272d7b6d7f1dca1957f696

I get a 500 Internal Server page as a result.

The same happens regardless of the contents of the refresh_token.

[Potherca]

I'm guessing this is caused by the logic expecting a code to be present in the request body.

solid-nextcloud/solid/lib/Controller/ServerController.php

Line 300 in 5daf9f7

$code = $request->getParsedBody()['code'];

No code seems to be present in the request body:

• grant_type
• client_id
• client_secret
• scope
• refresh_token

The lack of code would trigger a Undefined array key "code" warning, which would explain the 500.

@poef If you are running this against a local (or dockerized) install, do you see any errors come by in the logs?

[Potherca]

If I remember the specs correctly, only the authorization_code Grant Type requires a code.

So a check needs to be added anyway. Not sure what the rest of the logic should look like without code, will need to check the specs for details.