A page returned for a changed page-token request: a continuation or a new search?

Open
  • Is something wrong?
#775 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@alexolivier is already working on this.

Since Oct 29, 2026.

  • #792 by @alexolivier — open

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
backend-api-design, security

Research direction

Start by reading spec §§8.2 and 8.2.2 alongside the suite behavior described in the issue. Decide whether a successful response to a changed page-token request is a continuation, a new search, or undefined, whether it must include a page object, and whether the error requirement should be strengthened. Done means the specification and suite expectations resolve these questions consistently.

Written by the indexing model from the issue text.

Description

authorization-api certification

When a request contains a token, all entities (e.g., subject, resource, action, context) and pagination parameters (e.g., limit) MUST be identical to the preceding request. PDPs SHOULD return an error when any entity or parameter has been changed. (spec §8.2)

Any Search API Response MAY include a page object, but if a response does not contain the entire result set, it MUST include this object. (spec §8.2.2)

§8.2 says what a PDP should do with a changed request, but not what a PDP that answers it anyway is answering: the next page of the original search, or the changed search from the start. Each reading leads to a different response: a continuation carries a page object, while a new search whose results fit in one page may leave it out.

Suite today. The suite sends the first page's token back with a changed limit, or a changed subject, resource or action. A 4xx passes; a 200 is a warning, and the page is still checked as a search response. Every check on that page is at its usual severity except one: a missing page object, which is a failure after a valid token, is a warning here. The suite does not compare such a page's results with the fixture.

Questions.

  1. Is a 200 to a changed page-token request a continuation of the original search, a new search, or undefined?
  2. Must it carry a page object?
  3. Could "SHOULD return an error" become a MUST, so that the question does not arise?
Dominant language
TypeScript
Stars
171
Forks
46
Avg merge
3h 29m
Merged PRs (30d)
38

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openid/authzen

All issues in openid/authzen

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.