Skip to content

Invalid Client ID - does not throw exception, or jump to callback #227

@MattAllatt

Description

@MattAllatt

I have been experimenting with some "what happens if a user entered rubbish data" tests for my website, which uses Azure Portal get an Access/Refresh token.

Entering invalid client certificates, or client secrets give exceptions on the callback page - presumably, the getAccessToken function/method.
Entering an invalid tenant id causes an exception to be thrown in the getAuthorizationUrl function/method.

Entering an invalid client id, however, does neither of those, and just leaves me hanging on the login.microsoftonline.com page, with a familiar-looking error message (the ones starting AADSTS...)

I'm wondering if there's a more graceful way of handling a bad client id, like a way of catching the bad client id as an exception? I guess a bad client id means it doesn't call the callback, so it would be something akin to the invalid tenant id. Am I missing something? Here's my code...

try 
{
        $azure = new Azure(Array('clientId' => $clientId,
            'tenant' => $tenantId,
            'clientSecret' => $clientSecret,
            'redirectUri' => $callback,
            'defaultEndPointVersion' => '2.0'));
        $azure->scope = 'offline_access https://outlook.office.com/SMTP.Send';
        $authUrl = $azure->getAuthorizationUrl(['scope' => $azure->scope]);
        $_SESSION['OAuth2.state'] = $azure->getState();
        header('Location: ' . $authUrl);
}
catch(Exception $e)
{
...
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions