CodeCow/stack
1
0
Fork 0
mirror of https://github.com/stack-auth/stack.git synced 2026-07-20 21:29:36 +08:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

fix: guard against non-dict JSON in token refresh response

Browse Source 
resp.json() could return non-dict values (null, string, list) which
would cause AttributeError on data.get("access_token"). Now checks
isinstance(data, dict) first, returning (False, None) for malformed
responses. Applied to both sync and async refresh helpers.
This commit is contained in:
Ejiro Asiuwhu 2026-03-26 10:52:22 +01:00
parent b44fabc623
commit 6aaa4b3b4b
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sdks/implementations/python/src/stack_auth/_token_store.py
View File

@ -390,6 +390,8 @@ def _refresh_access_token_sync(
)
if resp.status_code == 200:
data = resp.json()
if not isinstance(data, dict):
return (False, None)
return (True, data.get("access_token"))
return (False, None)
except (httpx.HTTPError, ValueError, KeyError) as exc:
@ -421,6 +423,8 @@ async def _refresh_access_token_async(
)
if resp.status_code == 200:
data = resp.json()
if not isinstance(data, dict):
return (False, None)
return (True, data.get("access_token"))
return (False, None)
except (httpx.HTTPError, ValueError, KeyError) as exc: