Token response includes non-standard "user" PII field (resolves existing TODO)

Open Beginner friendly
#2,753 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
88/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
python
Domain
api, authentication

Research direction

Open app/oauth/views/token.py at the token endpoint response around line 82 and review the existing TODO. Remove the non-standard user field, then verify the response contains only the appropriate OAuth token fields and that user information remains available through the /oauth2/userinfo endpoint.

Written by the indexing model from the issue text.

Description

Describe the bug
The token endpoint response includes a non-standard "user" field containing personally identifiable information (PII) such as the user's email, name, and ID:

# app/oauth/views/token.py line 82
res = {
    "access_token": oauth_token.access_token,
    "token_type": "Bearer",
    "expires_in": 3600,
    "scope": auth_code.scope,
    "user": user_data,  # todo: remove this
}

Per RFC 6749 Section 5.1, the standard token response fields are strictly limited to access_token, token_type, expires_in, refresh_token, and scope. Including PII in the token response means that any party or network observer that can see the token exchange will also receive the user's PII, even if they only requested an access token.
The inline comment # todo: remove this indicates this was already identified as technical debt to be cleaned up.

Expected behavior
Remove the "user" field from the token response dictionary. Clients requiring user information should fetch it via the standard /oauth2/userinfo endpoint using the issued access token.

Additional context
File: app/oauth/views/token.py line 82.

Dominant language
Python
Stars
7k
Forks
650
Avg merge
18h 53m
Merged PRs (30d)
9

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from simple-login/app

All issues in simple-login/app

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.